Merge upstream main into OMP support

Author: emo-nm

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "memex"
-version = "0.9.1"
+version = "0.10.1"
 edition = "2024"
 build = "build.rs"
 description = "CLI tool for indexing and searching local agent conversation history"
@@ -47,5 +47,9 @@ tempfile = "3"
 libc = "0.2"
 libloading = { version = "0.8", optional = true }
 tiny_http = "0.12"
+base64 = "0.22"
+getrandom = "0.3"
+hmac = "0.12"
+subtle = "2.6"
 
 [dev-dependencies]

Cargo.toml

@@ -1,6 +1,6 @@
 # memex
 
-Fast local history search for Claude, Codex CLI, Cursor, OpenCode, Pi Coding Agent, Oh My Pi, OpenClaw, and GitHub Copilot CLI logs. Uses BM-25 and optionally embeds your transcripts locally for hybrid search.
+Fast local history search for Claude, Codex CLI, Cursor, OpenCode, Pi Coding Agent, Oh My Pi, OpenClaw, GitHub Copilot CLI, and Hermes usage records. Uses BM-25 and optionally embeds your transcripts locally for hybrid search.
 
 Mostly intended for agents to use via skill. The intended workflow is to ask agent about a previous session & then the agent can narrow things down & retrieve history as needed.
 
@@ -213,19 +213,20 @@ Token tracking is disabled by default because it scans and caches local agent lo
 token_usage = true
 ```
 
-Then reconstruct historical token usage from local Claude Code, Codex, Cursor, OpenCode, Pi, Oh My Pi, OpenClaw, and Copilot logs:
+Then reconstruct historical token usage from local Claude Code, Codex, Cursor, OpenCode, Pi, Oh My Pi, OpenClaw, Copilot, and Hermes records:
 
 ```
 memex usage
 memex usage --source codex --since 2026-07-01
+memex usage --source hermes --since 2026-07-01
 memex usage --json --events
 ```
 
 `--cost auto` prefers a provider-stored request cost and otherwise applies the versioned built-in API price catalog. `--cost source` uses only stored costs; `--cost reprice` always applies the catalog. Calculated costs are API-equivalent estimates, not subscription charges. Events with unknown models or prices remain in token totals and are reported as unpriced.
 
 Each source also reports prompt-cache efficiency: the cache hit rate, plus an estimate of cache waste — prompt tokens that were in the previous request's prompt but were re-billed at input rates instead of read from cache, priced at catalog rates and attributed to idle gaps past the cache TTL or model switches where those apply. Waste is estimated per transcript file chain and errs toward undercounting: subagent sidechains, ambiguous dedupe deltas, and prompts that shrink past compaction are not counted.
 
-Local token history is reconstructed usage. It is deliberately kept separate from authoritative subscription quota percentages and reset windows.
+Local token history is reconstructed usage. It is deliberately kept separate from authoritative subscription quota percentages and reset windows. Hermes usage is read from `state.db` in the Hermes root and immediate profile directories (`HERMES_PROFILE_ROOTS`, `HERMES_HOME`, or `HERMES_STATE_DIR`, with safe local defaults), opened read-only and WAL-compatible. The `sessions` aggregate is used for legacy databases; newer `session_model_usage` delta rows are emitted by model/task and reconciled against the session aggregate so historical seeded rows count once and positive residuals are retained. Snapshots, backups, arbitrary nested databases, JSON/JSONL transcripts, and auth, config, memory, skills, plugins, and cron paths are excluded. Hermes queries never read message, system-prompt, tool, reasoning-text, or credential tables. Usage output contains counters and metadata only. Any API-equivalent cost estimate is analytical and is not a Hermes subscription quota measurement; source-stored API costs are not quota percentages. Hermes parser-version changes invalidate only Hermes usage cache rows.
 
 When token tracking is enabled, press `Ctrl+T` on the TUI home screen to toggle the 30-day activity chart between session count and token volume. Token activity is loaded lazily and cached when first shown.
 
@@ -269,7 +270,7 @@ This detects which tools are installed (Claude/Codex/OpenCode/Pi/Oh My Pi) and p
 - `--role <user|assistant|tool_use|tool_result>`
 - `--tool <tool_name>`
 - `--session <session_id>`
-- `--source claude|codex|cursor|opencode|pi|omp|openclaw|copilot`
+- `--source claude|codex|cursor|opencode|pi|omp|openclaw|copilot|hermes`
 - `--since <iso|unix>` / `--until <iso|unix>`
 - `--limit <n>`
 - `--min-score <float>`
@@ -296,6 +297,21 @@ memex index-service enable --continuous
 memex index-service enable --web-ui
 ```
 
+Regenerate the service from current config and restart it:
+```
+memex index-service restart
+```
+
+Inspect the registered service and whether it is serving the Web UI:
+```
+memex index-service status
+```
+
+Open an authenticated browser session:
+```
+memex index-service open
+```
+
 Disable:
 ```
 memex index-service disable
@@ -310,18 +326,31 @@ On successful enable, memex writes `auto_index_on_search = false` to config when
 `http://127.0.0.1:6363`. It mirrors the TUI's core workflow with search-as-you-type,
 source and project filters, a persistent session list, and Matches/History transcript
 previews. The server binds to loopback by default because the index
-contains private conversation history. Override the address explicitly when needed:
+contains private conversation history. Memex refuses non-loopback HTTP listeners. If
+remote access is required, use an authenticated TLS reverse proxy to `127.0.0.1` that
+injects the installation bearer token into upstream requests. To use a different local port:
 
 ```
 memex index-service enable --web-listen 127.0.0.1:8080
+memex index-service open --listen 127.0.0.1:8080
 ```
 
+The first Web UI start creates `~/.memex/web-auth-token` with mode `0600`. Private API
+routes require that token as `Authorization: Bearer ...` or a browser session established
+by `index-service open`. Browser links carry a signed, one-time credential in the URL
+fragment, remove it before navigation continues, and exchange it for an ephemeral bearer
+token held only in page memory. The browser token is never stored in a cookie,
+`localStorage`, or session storage. Browser sessions expire after 12 hours, disappear when
+the page closes, and are invalidated whenever the daemon restarts.
+
 To run the same UI in the foreground without changing the background service:
 
 ```
 memex web
 ```
 
+Then run `memex index-service open` from another terminal.
+
 The browser frontend lives in `web/`, uses React and shadcn components, and is
 built with `cd web && bun install && bun run build`. The generated static assets
 are embedded in the memex binary, so serving the UI does not add a JavaScript

README.md

@@ -49,11 +49,6 @@
               pkg-config
               openssl
               rustToolchain
-            ]
-            ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
-              pkgs.darwin.apple_sdk.frameworks.Security
-              pkgs.darwin.apple_sdk.frameworks.CoreFoundation
-              pkgs.darwin.apple_sdk.frameworks.SystemConfiguration
             ];
 
           nativeBuildInputs = with pkgs; [pkg-config];

flake.nix

@@ -8,7 +8,7 @@
 # with exactly this version.
 id = "nicosuave.memex"
 name = "memex"
-version = "0.9.1"
+version = "0.10.1"
 min_herdr_version = "0.7.0"
 platforms = ["macos", "linux"]
 description = "Session desk for your agent history: search past Claude Code / Codex / Cursor / Pi / Oh My Pi sessions and resume one into a herdr tab."

herdr-plugin.toml

@@ -240,26 +240,23 @@ web)
   log="$dir/web.log"
   url="http://$web_listen"
   # Reuse a server that is already up — the background index service may well be serving it.
-  if ! curl -fsS -m 1 "$url/api/stats" >/dev/null 2>&1; then
+  if ! curl -fsS -m 1 "$url/healthz" >/dev/null 2>&1; then
     nohup "$MEMEX" web --listen "$web_listen" ${MEMEX_ROOT:+--root "$MEMEX_ROOT"} >>"$log" 2>&1 </dev/null &
     # The assets are embedded in the binary, so it comes up fast; give it ~3s anyway.
     up=""
     for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
       sleep 0.2
-      if curl -fsS -m 1 "$url/api/stats" >/dev/null 2>&1; then
+      if curl -fsS -m 1 "$url/healthz" >/dev/null 2>&1; then
         up=1
         break
       fi
     done
     [ -n "$up" ] || refuse "memex web did not come up on $web_listen, see $log"
   fi
-  case "$(uname -s)" in
-  Darwin) opener="open" ;;
-  *) opener="xdg-open" ;;
-  esac
-  command -v "$opener" >/dev/null 2>&1 || refuse "$opener not found; memex web is running at $url"
-  "$opener" "$url" >/dev/null 2>&1 || refuse "failed to open $url with $opener"
-  printf 'opened %s\n' "$url"
+  open_args=(index-service open --listen "$web_listen")
+  [ -n "${MEMEX_ROOT:-}" ] && open_args+=(--root "$MEMEX_ROOT")
+  "$MEMEX" "${open_args[@]}" >/dev/null 2>&1 || refuse "failed to open authenticated memex web UI at $url"
+  printf 'opened authenticated %s\n' "$url"
   ;;
 
 startup)

herdr/plugin.sh

@@ -5,7 +5,6 @@
   openssl,
   onnxruntime,
   stdenv,
-  darwin,
 }:
 rustPlatform.buildRustPackage {
   pname = "memex";
@@ -25,11 +24,6 @@ rustPlatform.buildRustPackage {
     [
       openssl
       onnxruntime
-    ]
-    ++ lib.optionals stdenv.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   # Tests require network access to download embedding models