fix(server): restrict dev-mode cross-origin requests

.gitattributes

@@ -0,0 +1,10 @@
+# Shared runtime copies generated by examples/memory-plugin-shared/sync.mjs.
+# Only the plugins a host installs by pointing at a directory in this repository
+# keep their copies in git; the rest are built at pack time and gitignored.
+examples/claude-code-memory-plugin/scripts/shared/*.mjs linguist-generated=true
+examples/codex-memory-plugin/scripts/shared/*.mjs linguist-generated=true
+agent-plugins/servers/shared/*.mjs linguist-generated=true
+
+# Regenerated by the TanStack Router plugin during every Studio build, which
+# writes LF. Pin LF so Windows checkouts (core.autocrlf=true) stay clean.
+web-studio/src/routeTree.gen.ts text eol=lf

.github/host-compat.json

@@ -0,0 +1,52 @@
+{
+  "hosts": [
+    {
+      "id": "dsh",
+      "name": "DeepSeek Harness",
+      "plugin": "examples/dsh-memory-plugin",
+      "probe": "@deepseek-ai/dsh",
+      "tags": [
+        "latest",
+        "next",
+        "alpha"
+      ],
+      "packages": "^@deepseek-ai/dsh(-.+)?$",
+      "includePrerelease": true,
+      "tests": "*.test.mjs",
+      "skipTests": [
+        "bundle.test.mjs"
+      ],
+      "smoke": [
+        {
+          "run": [
+            "npm",
+            "install",
+            "--no-audit",
+            "--no-fund",
+            "@deepseek-ai/dsh@{version}"
+          ]
+        },
+        {
+          "run": [
+            "./node_modules/.bin/dsh",
+            "plugin",
+            "--profile",
+            "web",
+            "add",
+            "{tarball}"
+          ]
+        },
+        {
+          "run": [
+            "./node_modules/.bin/dsh",
+            "--profile",
+            "web",
+            "--dump-config"
+          ],
+          "expect": "^- id: openviking-memory-runtime$"
+        }
+      ],
+      "notes": "DSH checks @deepseek-ai/dsh-* peers at plugin load with prereleases included. bundle.test.mjs asserts the dev pins stay at the tested minimum, which this check replaces on purpose. The smoke steps install that dsh release, add the packed bundle to a profile, and require the composed profile to include the bundle; DSH refuses to add a bundle whose peers reject the release, so the add step fails first."
+    }
+  ]
+}

.github/scripts/build-plugin-downloads.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Build the downloads the docs site serves under /dl: the installer, the plugin
+# bundle, the Claude Code URL marketplace, the Codex git marketplace and the
+# channel data of the version check, laid out like the TOS release bucket. Each docs host publishes the tree built from
+# the commit it deploys, with its own address in the marketplace manifest.
+
+set -euo pipefail
+
+USAGE="usage: build-plugin-downloads.sh <out-dir> <base-url>"
+OUT="${1:?${USAGE}}"
+BASE="${2:?${USAGE}}"
+BASE="${BASE%/}"
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
+SCRIPTS="${ROOT}/.github/scripts"
+SHARED="${ROOT}/examples/memory-plugin-shared"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/ov-downloads.XXXXXX")"
+trap 'rm -rf "${WORK}"' EXIT
+
+# The commit the tree was built from, so a published installer can be compared
+# with the repository copy at that commit.
+VERSION="$(TZ=UTC git -C "${ROOT}" log -1 --abbrev=10 --format=%cd-%h --date=format-local:%Y%m%d)"
+# Docs deploy on every change, so a zip must only change when its content does:
+# the Claude Code zip keeps its name for as long as the plugin version does.
+export ZIP_STAMP=200001010000.00
+
+STAGE="${WORK}/memory-plugin-marketplace"
+bash "${SCRIPTS}/stage-memory-plugin-marketplace.sh" "${STAGE}"
+PLUGIN_VERSION="$(jq -r .version "${STAGE}/claude-code-memory-plugin/.claude-plugin/plugin.json")"
+CLAUDE_ZIP="plugins/claude/openviking-memory-${PLUGIN_VERSION}.zip"
+
+rm -rf "${OUT}"
+mkdir -p "${OUT}/memory-plugin-shared" "${OUT}/releases/latest" "${OUT}/plugins/claude"
+case "${OUT}" in /*) ;; *) OUT="${PWD}/${OUT}" ;; esac
+
+bash "${SCRIPTS}/stamp-installer-version.sh" "${SHARED}/install.sh" "${VERSION}" "${OUT}/memory-plugin-shared/install.sh"
+cp "${SHARED}/bootstrap.sh" "${OUT}/memory-plugin-shared/bootstrap.sh"
+
+# The git marketplace is committed before the zips are built: zipping resets
+# the staged files' times. Like the zips, the repository keeps its bytes until
+# the plugins change: a new commit and pack name on every deploy leaves the CDN
+# serving refs and packs of different deploys for a while, failing git clients.
+SRC="${WORK}/memory-plugins-src"
+cp -R "${STAGE}" "${SRC}"
+git -C "${SRC}" init -q -b main
+git -C "${SRC}" add -A
+# Background auto-maintenance would repack while the clone below reads.
+GIT_AUTHOR_DATE="2000-01-01T00:00:00Z" GIT_COMMITTER_DATE="2000-01-01T00:00:00Z" \
+  git -C "${SRC}" -c maintenance.auto=false -c user.email=release@openviking.org -c user.name="OpenViking Release" \
+  commit -qm "OpenViking memory plugins"
+git clone -q --bare "${SRC}" "${OUT}/plugins/memory-plugins.git"
+git -C "${OUT}/plugins/memory-plugins.git" -c pack.threads=1 repack -adq
+git -C "${OUT}/plugins/memory-plugins.git" update-server-info
+# Static hosts serve files only; the sample hooks are of no use to a client.
+rm -rf "${OUT}/plugins/memory-plugins.git/hooks"
+
+bash "${SCRIPTS}/reproducible-zip.sh" "${OUT}/releases/latest/memory-plugin-marketplace.zip" "${WORK}" memory-plugin-marketplace
+bash "${SCRIPTS}/reproducible-zip.sh" "${OUT}/${CLAUDE_ZIP}" "${STAGE}" claude-code-memory-plugin
+bash "${SCRIPTS}/generate-claude-marketplace-json.sh" "${BASE}/${CLAUDE_ZIP}" \
+  "${OUT}/${CLAUDE_ZIP}" "${STAGE}" "${OUT}/plugins/claude/marketplace.json"
+
+# What the install site's version check answers with. No checksum: the two
+# hosts deploy one after the other and keep no earlier build, so a pinned
+# bundle would fail to verify while they differ.
+jq -n \
+  --arg version "${VERSION}" \
+  --arg git_url "${BASE}/plugins/memory-plugins.git" \
+  --arg bundle_url "${BASE}/releases/latest/memory-plugin-marketplace.zip" \
+  '{schema: 1, harnesses: (
+      {codex: {version: $version, git_url: $git_url}}
+      + (["claude", "cursor", "trae", "trae-cli", "trae-cn", "zcode", "kimicode",
+          "opencode", "pi", "dsh"] | map({key: ., value: {version: $version, bundle_url: $bundle_url}}) | from_entries)
+    )}' > "${OUT}/releases/latest/channels.json"
+
+echo "Built plugin downloads ${VERSION} for ${BASE}"

.github/scripts/check-marketplace-archive.mjs

@@ -0,0 +1,252 @@
+#!/usr/bin/env node
+
+// What the marketplace archive must contain is not a list anybody keeps: it is
+// what each plugin's manifests name, what those entrypoints import, and what the
+// shared-module sync generates. The hand-typed list this replaced was a second
+// copy of all three and had drifted from every one of them — it named eleven of
+// the twenty-two modules the installer assembles and four of the thirty-eight
+// copies the sync generates.
+
+import { realpathSync } from "node:fs";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  MANIFEST_PATH,
+  ROOT,
+  assembledClosure,
+  importSpecifiers,
+  resolveTargets,
+} from "../../examples/memory-plugin-shared/sync.mjs";
+
+const EXAMPLES = join(ROOT, "examples");
+
+// Manifests a host reads by name to find everything else.
+const HOST_MANIFESTS = ["openviking.integration.json", ".mcp.json", "hooks.json", join("hooks", "hooks.json")];
+const PACKAGE_MANIFESTS = ["plugin.json"];
+
+// Directories a host loads whole; what is inside them is named nowhere.
+const CONTENT_DIRS = ["skills", "rules", "commands"];
+
+// Command hooks name .mjs/.cjs/.js scripts; a Claude Code hooks module (`modules`
+// in hooks.json) names a .ts/.tsx file.
+const SCRIPT_RE = /[^\s"'`]+\.(?:mjs|cjs|js|tsx?)\b/g;
+
+// TypeScript imports leave the extension off: "./sources" is sources.ts.
+const TS_EXTENSIONS = ["", ".ts", ".tsx", ".d.ts"];
+
+async function isFile(path) {
+  return stat(path)
+    .then((info) => info.isFile())
+    .catch(() => false);
+}
+
+async function isDirectory(path) {
+  return stat(path)
+    .then((info) => info.isDirectory())
+    .catch(() => false);
+}
+
+async function filesUnder(dir, out = []) {
+  const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) await filesUnder(path, out);
+    else if (entry.isFile()) out.push(path);
+  }
+  return out;
+}
+
+/** Every string a JSON document holds, at any depth. */
+function jsonStrings(value, out = []) {
+  if (typeof value === "string") out.push(value);
+  else if (Array.isArray(value)) for (const item of value) jsonStrings(item, out);
+  else if (value && typeof value === "object") for (const item of Object.values(value)) jsonStrings(item, out);
+  return out;
+}
+
+/**
+ * The file a host-templated command names, if the plugin has it.
+ *
+ * Each host writes its plugin root differently — `${CLAUDE_PLUGIN_ROOT}`,
+ * `__OPENVIKING_PLUGIN_ROOT__`, `$PLUGIN_DIR`, or nothing at all — so the
+ * prefix is dropped a segment at a time until what is left is a file in the
+ * plugin, which may be one the plugin reaches across its own boundary.
+ */
+async function resolveInPlugin(root, token) {
+  const parts = token.split("/").filter((part) => part && part !== ".");
+  for (let i = 0; i < parts.length; i += 1) {
+    const candidate = join(root, ...parts.slice(i));
+    if (await isFile(candidate)) return candidate;
+  }
+  return null;
+}
+
+async function namedScripts(root, text) {
+  const found = [];
+  for (const token of text.match(SCRIPT_RE) || []) {
+    const path = await resolveInPlugin(root, token);
+    if (path) found.push(path);
+  }
+  return found;
+}
+
+/** Every module reachable from `entries` by relative import, entries included. */
+async function importClosure(entries) {
+  const reached = new Set();
+  const pending = [...entries];
+  while (pending.length) {
+    const spec = pending.pop();
+    let file = null;
+    for (const ext of TS_EXTENSIONS) {
+      if (await isFile(spec + ext)) {
+        file = spec + ext;
+        break;
+      }
+    }
+    if (!file || reached.has(file)) continue;
+    reached.add(file);
+    const source = await readFile(file, "utf-8");
+    for (const spec of importSpecifiers(source)) {
+      if (spec.startsWith(".")) pending.push(resolve(dirname(file), spec));
+    }
+  }
+  return reached;
+}
+
+/**
+ * Where one plugin's host manifests sit: its own root, plus a directory per host
+ * for a plugin that serves several of them.
+ */
+async function manifestRoots(root) {
+  const roots = [root];
+  for (const entry of await readdir(join(root, "hosts"), { withFileTypes: true }).catch(() => [])) {
+    if (entry.isDirectory()) roots.push(join(root, "hosts", entry.name));
+  }
+  return roots;
+}
+
+/** The manifests, entrypoints and content one staged plugin directory owes. */
+async function pluginRequirements(root) {
+  const required = new Set();
+  const entrypoints = new Set();
+  for (const manifest of PACKAGE_MANIFESTS) {
+    if (await isFile(join(root, manifest))) required.add(join(root, manifest));
+  }
+
+  for (const entry of await readdir(root, { withFileTypes: true }).catch(() => [])) {
+    // `.claude-plugin/`, `.codex-plugin/`: the host's own manifest directory,
+    // always small and always shipped whole.
+    if (entry.isDirectory() && entry.name.startsWith(".")) {
+      for (const file of await filesUnder(join(root, entry.name))) required.add(file);
+    }
+  }
+  for (const host of await manifestRoots(root)) {
+    for (const manifest of HOST_MANIFESTS) {
+      if (await isFile(join(host, manifest))) required.add(join(host, manifest));
+    }
+    for (const dir of CONTENT_DIRS) {
+      for (const file of await filesUnder(join(host, dir))) required.add(file);
+    }
+  }
+
+  for (const file of [...required]) {
+    if (file.endsWith(".json")) {
+      for (const value of jsonStrings(JSON.parse(await readFile(file, "utf-8")))) {
+        for (const script of await namedScripts(root, value)) entrypoints.add(script);
+      }
+    } else if (file.endsWith(".md")) {
+      // A skill's own document is its manifest: the command it tells the agent
+      // to run has to be in the archive too.
+      for (const script of await namedScripts(root, await readFile(file, "utf-8"))) {
+        entrypoints.add(script);
+      }
+    }
+  }
+
+  for (const file of await importClosure([...entrypoints])) required.add(file);
+  return required;
+}
+
+/** Every file the staged marketplace tree must hold, relative to its root. */
+export async function requiredArchiveFiles(stagedNames) {
+  const staged = new Set(stagedNames);
+  const required = new Set();
+  // The config-driven hook hosts import the shared runtime across the plugin
+  // boundary; anything outside the staged tree is not this archive's.
+  const addIfStaged = (path) => {
+    const name = relative(EXAMPLES, path);
+    if (!name.startsWith("..") && staged.has(name.split(sep)[0])) required.add(name);
+  };
+
+  for (const name of staged) {
+    if (name === "memory-plugin-shared") continue;
+    const root = join(EXAMPLES, name);
+    if (!(await isDirectory(root))) continue;
+    // `.claude-plugin/` and `.agents/` are the marketplace manifests the
+    // installer registers the unzipped directory with, not plugins.
+    if (name.startsWith(".")) {
+      for (const file of await filesUnder(root)) addIfStaged(file);
+      continue;
+    }
+    for (const file of await pluginRequirements(root)) addIfStaged(file);
+    if (name === "pi-coding-agent-extension") {
+      addIfStaged(join(root, "package.json"));
+      addIfStaged(join(root, "package-lock.json"));
+    }
+  }
+
+  // The plugins that vendor a copy of the shared runtime ship what the sync put
+  // there, and the harnesses that vendor nothing ship the closure the installer
+  // assembles for them, named by the manifest the installer reads.
+  for (const target of await resolveTargets()) {
+    const dir = relative(EXAMPLES, target.dir);
+    if (dir.startsWith("..") || !staged.has(dir.split(sep)[0])) continue;
+    for (const file of target.files) required.add(join(dir, file));
+  }
+  if (staged.has("memory-plugin-shared")) {
+    addIfStaged(MANIFEST_PATH);
+    for (const file of await assembledClosure()) addIfStaged(join(dirname(MANIFEST_PATH), file));
+  }
+
+  return [...required].sort();
+}
+
+async function main(stage, expected) {
+  const missing = [];
+  for (const name of expected) {
+    if (!(await isDirectory(join(stage, name)))) missing.push(`${name}/`);
+  }
+  for (const file of await requiredArchiveFiles(expected)) {
+    if (!(await isFile(join(stage, file)))) missing.push(file);
+  }
+  if (missing.length) {
+    for (const file of missing) process.stderr.write(`Marketplace archive is missing ${file}\n`);
+    process.exit(1);
+  }
+}
+
+function isDirectRun() {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+  }
+}
+
+if (isDirectRun()) {
+  const [stage, ...expected] = process.argv.slice(2);
+  // The expected directories are the caller's list, not the stage's own: a name
+  // dropped from it would otherwise leave both this check and the staging script
+  // agreeing that whatever happens to be there is complete.
+  if (!stage || !expected.length) {
+    process.stderr.write("usage: check-marketplace-archive.mjs <stage-dir> <plugin-dir>...\n");
+    process.exit(2);
+  }
+  main(stage, expected).catch((err) => {
+    process.stderr.write(`${err?.stack || err}\n`);
+    process.exit(1);
+  });
+}