chore(openmemory-js): security & test hardening (P1+P2 close-out)

packages/openmemory-js/package.json

@@ -13,7 +13,11 @@
         "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
         "build": "tsc -p tsconfig.json",
         "start": "node dist/server/index.js",
-        "migrate": "tsx src/migrate.ts"
+        "migrate": "tsx src/core/migrate.ts",
+        "test": "vitest run",
+        "test:watch": "vitest",
+        "test:coverage": "vitest run --coverage",
+        "typecheck": "tsc --noEmit -p tsconfig.json"
     },
     "dependencies": {
         "@aws-sdk/client-bedrock-runtime": "^3.932.0",
@@ -40,8 +44,10 @@
         "@types/fluent-ffmpeg": "^2.1.26",
         "@types/node": "^20.19.25",
         "@types/pg": "^8.15.6",
+        "@vitest/coverage-v8": "^2.1.9",
         "prettier": "^3.6.2",
         "tsx": "^4.20.6",
-        "typescript": "^5.9.3"
+        "typescript": "^5.9.3",
+        "vitest": "^2.1.9"
     }
 }

packages/openmemory-js/src/ai/graph.ts

@@ -295,9 +295,9 @@ export async function get_graph_ctx(p: lgm_context_req) {
     );
     const summ = flat.length
         ? flat
-            .slice(0, lim)
-            .map((ln) => `- [${ln.node}] ${ln.content}`)
-            .join("\n")
+              .slice(0, lim)
+              .map((ln) => `- [${ln.node}] ${ln.content}`)
+              .join("\n")
         : "";
     return {
         namespace: ns,

packages/openmemory-js/src/ai/mcp_tools.ts

@@ -1,8 +1,12 @@
 import { z } from "zod/v3";
 import { zodToJsonSchema } from "zod-to-json-schema";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { CallToolRequestSchema, ListToolsRequestSchema, McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
-
+import {
+    CallToolRequestSchema,
+    ListToolsRequestSchema,
+    McpError,
+    ErrorCode,
+} from "@modelcontextprotocol/sdk/types.js";
 
 type ToolCallback = (args: any, extra?: any) => Promise<any> | any;
 
@@ -16,67 +20,75 @@ interface ToolDef {
 export class ToolRegistry {
     private tools: Map<string, ToolDef> = new Map();
 
-    tool(name: string, description: string, inputSchema: any, callback: ToolCallback) {
+    tool(
+        name: string,
+        description: string,
+        inputSchema: any,
+        callback: ToolCallback,
+    ) {
         this.tools.set(name, {
             name,
             description,
             inputSchema: z.object(inputSchema),
-            callback
+            callback,
         });
     }
 
     apply(server: McpServer) {
-
-
         const srv = server.server;
 
         srv.setRequestHandler(ListToolsRequestSchema, async () => {
             return {
-                tools: Array.from(this.tools.values()).map(t => {
+                tools: Array.from(this.tools.values()).map((t) => {
                     const jsonSchema = zodToJsonSchema(t.inputSchema, {
-                        target: "jsonSchema2019-09"
+                        target: "jsonSchema2019-09",
                     }) as Record<string, unknown>;
 
-
-                    if (jsonSchema && typeof jsonSchema === 'object') {
-
-
-
-
+                    if (jsonSchema && typeof jsonSchema === "object") {
                         delete jsonSchema.$schema;
                     }
 
                     return {
                         name: t.name,
                         description: t.description,
-                        inputSchema: jsonSchema
+                        inputSchema: jsonSchema,
                     };
-                })
+                }),
             };
         });
 
-        srv.setRequestHandler(CallToolRequestSchema, async (req: any, extra: any) => {
-            const name = req.params.name;
-            const tool = this.tools.get(name);
-            if (!tool) {
-                throw new McpError(ErrorCode.MethodNotFound, `Tool not found: ${name}`);
-            }
-
-
-            const args = req.params.arguments || {};
-            const parse = await tool.inputSchema.safeParseAsync(args);
-            if (!parse.success) {
-                throw new McpError(ErrorCode.InvalidParams, `Invalid arguments: ${parse.error.message}`);
-            }
-
-            try {
-                return await tool.callback(parse.data, extra);
-            } catch (err: any) {
-                return {
-                    content: [{ type: "text", text: `Error: ${err.message}` }],
-                    isError: true
-                };
-            }
-        });
+        srv.setRequestHandler(
+            CallToolRequestSchema,
+            async (req: any, extra: any) => {
+                const name = req.params.name;
+                const tool = this.tools.get(name);
+                if (!tool) {
+                    throw new McpError(
+                        ErrorCode.MethodNotFound,
+                        `Tool not found: ${name}`,
+                    );
+                }
+
+                const args = req.params.arguments || {};
+                const parse = await tool.inputSchema.safeParseAsync(args);
+                if (!parse.success) {
+                    throw new McpError(
+                        ErrorCode.InvalidParams,
+                        `Invalid arguments: ${parse.error.message}`,
+                    );
+                }
+
+                try {
+                    return await tool.callback(parse.data, extra);
+                } catch (err: any) {
+                    return {
+                        content: [
+                            { type: "text", text: `Error: ${err.message}` },
+                        ],
+                        isError: true,
+                    };
+                }
+            },
+        );
     }
 }

packages/openmemory-js/src/core/cfg.ts

@@ -57,7 +57,8 @@ export const env = {
     AWS_REGION: process.env.AWS_REGION || "",
     AWS_ACCESS_KEY_ID: process.env.AWS_ACCESS_KEY_ID || "",
     AWS_SECRET_ACCESS_KEY: process.env.AWS_SECRET_ACCESS_KEY || "",
-    siray_key: process.env.SIRAY_API_TOKEN || process.env.OM_SIRAY_API_TOKEN || "",
+    siray_key:
+        process.env.SIRAY_API_TOKEN || process.env.OM_SIRAY_API_TOKEN || "",
     siray_base_url: str(
         process.env.OM_SIRAY_BASE_URL,
         "https://api.siray.ai/v1",
@@ -81,7 +82,10 @@ export const env = {
         process.env.OM_METADATA_BACKEND,
         "sqlite",
     ).toLowerCase(),
-    vector_backend: str(process.env.OM_VECTOR_BACKEND, "postgres").toLowerCase(),
+    vector_backend: str(
+        process.env.OM_VECTOR_BACKEND,
+        "postgres",
+    ).toLowerCase(),
     valkey_host: str(process.env.OM_VALKEY_HOST, "localhost"),
     valkey_port: num(process.env.OM_VALKEY_PORT, 6379),
     valkey_password: process.env.OM_VALKEY_PASSWORD,