@echomem/mcp 1.4.21 → 1.4.22

package/README.md

@@ -66,7 +66,7 @@ HUD; the granular commands below still work.
 | `npx -y @echomem/mcp@latest setup` | One-off setup without keeping a global CLI command |
 | `echomem-mcp setup [--client cursor\|windsurf\|claude-desktop\|claude-code\|codex]` | Write client config + log in |
 | `echomem-mcp setup --skip-login [--client cursor\|windsurf\|claude-desktop\|claude-code\|codex]` | Write client config without opening the browser or changing credentials |
-| `npx -y @echomem/mcp@latest update --all` | One-shot update: repoint detected client configs to the latest bridge, with no browser login |
+| `npx -y @echomem/mcp@latest update --all` | One-shot update: install the latest bridge durably and repoint detected client configs, with no browser login |
 | `npx -y @echomem/mcp@latest update --client codex` | Update one client only |
 | `echomem-mcp setup --with-hud [--client codex]` | Write client config + log in + launch the EchoMem context HUD |
 | `echomem-mcp login` | Approve device in browser (or use `--token` / `--passphrase`) |

package/dist/setup-page/client-core.js

@@ -8,6 +8,9 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
       var status = document.getElementById("status");
       var report = null;
       var reportEnvelope = null;
+      // The local bridge is authoritative. Login never gets access to scan/import routes;
+      // onboarding may request the separate local-history permission.
+      var setupFlow = "onboarding";
       var activeScanId = "";
       var stats = null;
       var statsSlow = false;
@@ -27,6 +30,8 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
       var billingStatus = null;
       var billingStatusLoading = false;
       var setupPlanChoice = "";
+      var setupPlanPreview = "free";
+      var billingActivationPendingPlan = "";
       var selectedSessionKeys = Object.create(null);
       var sessionSelectionTouched = false;
       var sessionPickerQuery = "";
@@ -37,13 +42,30 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
       var localAuthAgeConfirmed = false;
       var statsPollStarted = false;
       var reportPollStarted = false;
+      var reportEstimateDeadline = 0;
+      var reportEstimateTimer = null;
+      var readyStage = "";
       var NIGHT_HOURS = { 22: 1, 23: 1, 0: 1, 1: 1, 2: 1, 3: 1 };
 
+      try {
+        var storedSetupPlanChoice = sessionStorage.getItem("echomem:setup-plan:" + nonce) || "";
+        if (storedSetupPlanChoice === "free" || storedSetupPlanChoice === "pro" || storedSetupPlanChoice === "power") {
+          setupPlanChoice = storedSetupPlanChoice;
+        }
+      } catch (_) {}
+
       function esc(value) {
         return String(value == null ? "" : value).replace(/[&<>"']/g, function (ch) {
           return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[ch];
         });
       }
+      function rememberSetupPlanChoice(choice) {
+        setupPlanChoice = choice === "free" || choice === "pro" || choice === "power" ? choice : "";
+        try {
+          if (setupPlanChoice) sessionStorage.setItem("echomem:setup-plan:" + nonce, setupPlanChoice);
+          else sessionStorage.removeItem("echomem:setup-plan:" + nonce);
+        } catch (_) {}
+      }
       function setupIcon(name) {
         var paths = {
           "shield-check": '<path d="M12 3 5 6v5c0 4.6 2.9 8.1 7 10 4.1-1.9 7-5.4 7-10V6l-7-3Z"/><path d="m8.8 12.1 2 2 4.4-4.5"/>',
@@ -152,14 +174,18 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
         return false;
       }
       function localAuthLegalHtml() {
-        return '<div class="localAuthLegal">' +
-          '<label><input type="checkbox" id="localAuthAge" ' + (localAuthAgeConfirmed ? "checked" : "") + ' />' +
-            '<span>I confirm that I am at least 18 years old.</span></label>' +
-          '<label><input type="checkbox" id="localAuthTerms" ' + (localAuthTermsAccepted ? "checked" : "") + ' />' +
-            '<span>I have read and agree to the Echo <a href="https://echoknows.com/terms-of-use" target="_blank" rel="noopener noreferrer">Terms of Use</a>, <a href="https://echoknows.com/memory-terms" target="_blank" rel="noopener noreferrer">Memory Usage Terms</a>, and <a href="https://echoknows.com/privacy-policy" target="_blank" rel="noopener noreferrer">Privacy Policy</a>. I understand Echo uses subprocessors listed <a href="https://echoknows.com/subprocessor-list" target="_blank" rel="noopener noreferrer">here</a>.</span></label>' +
-        '</div>';
+        return '<label class="localAuthConsent">' +
+          '<input type="checkbox" id="localAuthConsent" ' + (localAuthAgeConfirmed && localAuthTermsAccepted ? "checked" : "") + ' />' +
+          '<span>I confirm that I am at least 18 years old and that I have read and agree to Echo\'s <a href="https://echoknows.com/terms-of-use" target="_blank" rel="noopener noreferrer">Terms of Use</a>, <a href="https://echoknows.com/memory-terms" target="_blank" rel="noopener noreferrer">Memory Usage Terms</a>, and <a href="https://echoknows.com/privacy-policy" target="_blank" rel="noopener noreferrer">Privacy Policy</a>. See our <a href="https://echoknows.com/subprocessor-list" target="_blank" rel="noopener noreferrer">Subprocessor List</a>.</span>' +
+        '</label>';
       }
       function captureLocalAuthConsents() {
+        var consent = document.getElementById("localAuthConsent");
+        if (consent) {
+          localAuthTermsAccepted = !!consent.checked;
+          localAuthAgeConfirmed = !!consent.checked;
+          return;
+        }
         var terms = document.getElementById("localAuthTerms");
         var age = document.getElementById("localAuthAge");
         localAuthTermsAccepted = !!(terms && terms.checked);
@@ -185,19 +211,21 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
         setExtractMode(false);
         setReadyMode(true);
         setHead("Connect EchoMem", "Local login");
-        app.className = "localAuthStage";
+        app.className = "localAuthStage localAuthWelcomeStage";
         app.innerHTML =
-          '<section class="localAuthCard">' +
-            '<div class="localAuthLead">' +
-              '<img src="/hud-assets/echo-face-cutout.png" alt="" />' +
-              '<p class="consentEyebrow">EchoMem account / local login</p>' +
-              '<h2 class="siteHeadline">Sign in without leaving this device.</h2>' +
-              '<p>Echo sends a one-time code to your email. The browser stays on localhost; your device token and encryption key are stored only in the local EchoMem keystore.</p>' +
+          '<section class="localAuthWelcome" aria-labelledby="localAuthWelcomeTitle">' +
+            '<div class="localAuthOrbScene" aria-hidden="true"><span class="localAuthOrb"></span><span class="localAuthOrbShadow"></span></div>' +
+            '<div class="localAuthWelcomeCopy">' +
+              '<h2 id="localAuthWelcomeTitle">Welcome to Echo</h2>' +
+              '<p>Your memories, sovereign and shared.</p>' +
             '</div>' +
-            '<form class="localAuthForm" id="localAuthEmailForm">' +
-              '<label class="localAuthField"><span>Email</span><input id="localAuthEmail" type="email" autocomplete="email" placeholder="you@example.com" value="' + esc(localAuthEmail) + '" /></label>' +
+            '<form class="localAuthWelcomeForm" id="localAuthEmailForm">' +
+              '<div class="localAuthEmailCapsule">' +
+                '<label class="srOnly" for="localAuthEmail">Email</label>' +
+                '<input id="localAuthEmail" type="email" autocomplete="email" placeholder="Enter your email" value="' + esc(localAuthEmail) + '" />' +
+                '<button id="localAuthSend" type="submit" aria-label="Send one-time code"><span aria-hidden="true">→</span></button>' +
+              '</div>' +
               localAuthLegalHtml() +
-              '<button class="primary" id="localAuthSend" type="submit">Send code</button>' +
               '<p class="localAuthStatus' + (message ? " is-error" : "") + '" id="localAuthStatus" role="status" aria-live="polite">' + esc(message || "") + '</p>' +
             '</form>' +
           '</section>';
@@ -208,12 +236,37 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
           email.oninput = function () { localAuthEmail = String(email.value || ""); updateLocalAuthSendButton(); };
           email.focus();
         }
-        var terms = document.getElementById("localAuthTerms");
-        var age = document.getElementById("localAuthAge");
-        if (terms) terms.onchange = updateLocalAuthSendButton;
-        if (age) age.onchange = updateLocalAuthSendButton;
+        var consent = document.getElementById("localAuthConsent");
+        if (consent) consent.onchange = updateLocalAuthSendButton;
         updateLocalAuthSendButton();
       }
+      function renderLocalLoginComplete() {
+        setCityMode(false);
+        setScanMode(false);
+        setExtractMode(false);
+        setReadyMode(true);
+        setHead("EchoMem connected", "Done");
+        app.className = "notice";
+        app.innerHTML =
+          '<section class="localAuthCard localAuthComplete">' +
+            '<div class="localAuthLead">' +
+              '<img src="/hud-assets/echo-face-cutout.png" alt="" />' +
+              '<p class="consentEyebrow">This device is connected</p>' +
+              '<h2 class="siteHeadline">You\'re signed in.</h2>' +
+              '<p>Your local device token and encryption key are ready. Return to Terminal, or run <code>echomem-mcp init</code> when you want to start local-history onboarding.</p>' +
+            '</div>' +
+          '</section>';
+      }
+      async function finishLocalLogin() {
+        connected = true;
+        if (setupFlow === "login") {
+          renderLocalLoginComplete();
+          return;
+        }
+        rememberSetupPlanChoice("");
+        try { await refreshBillingStatus(); } catch (_) {}
+        await waitForStats();
+      }
       async function sendLocalOtp() {
         var email = document.getElementById("localAuthEmail");
         localAuthEmail = email && email.value ? String(email.value).trim().toLowerCase() : "";
@@ -224,7 +277,7 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
           return;
         }
         var button = document.getElementById("localAuthSend");
-        if (button) { button.disabled = true; button.textContent = "Sending..."; }
+        if (button) { button.disabled = true; button.innerHTML = '<span class="localAuthSpinner" aria-hidden="true"></span>'; }
         setLocalAuthStatus("Sending verification code...");
         try {
           var data = await postJson("/local-auth/send-otp", {
@@ -235,7 +288,7 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
           localAuthEmail = data.email || localAuthEmail;
           renderLocalOtp("Code sent. Check your inbox.");
         } catch (error) {
-          if (button) { button.disabled = false; button.textContent = "Send code"; }
+          if (button) { button.disabled = false; button.innerHTML = '<span aria-hidden="true">→</span>'; }
           setLocalAuthStatus(error && error.message ? error.message : "Could not send the code.", "error");
         }
       }
@@ -245,18 +298,26 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
         setExtractMode(false);
         setReadyMode(true);
         setHead("Check your email", "Local login");
-        app.className = "localAuthStage";
+        app.className = "localAuthStage localAuthWelcomeStage localAuthOtpStage";
         app.innerHTML =
-          '<section class="localAuthCard localAuthCardOtp">' +
-            '<div class="localAuthLead">' +
-              '<img src="/hud-assets/echo-face-cutout.png" alt="" />' +
-              '<p class="consentEyebrow">Verification code</p>' +
-              '<h2 class="siteHeadline">Enter the code sent to <strong>' + esc(localAuthEmail) + '</strong>.</h2>' +
-              '<p>This code signs in this local EchoMem bridge only. The next step asks for your encryption passphrase.</p>' +
+          '<section class="localAuthWelcome localAuthOtpWelcome" aria-labelledby="localAuthOtpTitle">' +
+            '<div class="localAuthOrbScene" aria-hidden="true"><span class="localAuthOrb"></span><span class="localAuthOrbShadow"></span></div>' +
+            '<div class="localAuthWelcomeCopy">' +
+              '<h2 id="localAuthOtpTitle">Check your inbox</h2>' +
+              '<p>We sent a 6-digit code to <strong>' + esc(localAuthEmail) + '</strong></p>' +
             '</div>' +
-            '<form class="localAuthForm" id="localAuthOtpForm">' +
-              '<label class="localAuthField"><span>6-digit code</span><input id="localAuthOtp" type="text" inputmode="numeric" autocomplete="one-time-code" maxlength="6" placeholder="123456" /></label>' +
-              '<div class="localAuthActions"><button class="primary" id="localAuthVerify" type="submit">Verify code</button><button class="textButton" id="localAuthBack" type="button">Use a different email</button></div>' +
+            '<form class="localAuthWelcomeForm localAuthOtpForm" id="localAuthOtpForm">' +
+              '<label class="srOnly" for="localAuthOtp0">6-digit code</label>' +
+              '<div class="localAuthOtpCells" aria-label="6-digit verification code">' +
+                '<input id="localAuthOtp0" data-otp-cell type="text" inputmode="numeric" autocomplete="one-time-code" maxlength="1" />' +
+                '<input data-otp-cell type="text" inputmode="numeric" maxlength="1" />' +
+                '<input data-otp-cell type="text" inputmode="numeric" maxlength="1" />' +
+                '<input data-otp-cell type="text" inputmode="numeric" maxlength="1" />' +
+                '<input data-otp-cell type="text" inputmode="numeric" maxlength="1" />' +
+                '<input data-otp-cell type="text" inputmode="numeric" maxlength="1" />' +
+              '</div>' +
+              '<button class="primary localAuthVerifyWide" id="localAuthVerify" type="submit">Verify</button>' +
+              '<button class="secondary localAuthBackWide" id="localAuthBack" type="button">Use another email</button>' +
               '<p class="localAuthStatus" id="localAuthStatus" role="status" aria-live="polite">' + esc(message || "") + '</p>' +
             '</form>' +
           '</section>';
@@ -264,12 +325,45 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
         if (form) form.onsubmit = function (event) { event.preventDefault(); void verifyLocalOtp(); };
         var back = document.getElementById("localAuthBack");
         if (back) back.onclick = function () { renderLocalLogin(""); };
-        var otp = document.getElementById("localAuthOtp");
+        bindLocalOtpCells();
+        var otp = document.querySelector("[data-otp-cell]");
         if (otp) otp.focus();
       }
+      function localOtpCellValues() {
+        return Array.prototype.map.call(document.querySelectorAll("[data-otp-cell]"), function (node) {
+          return String(node.value || "").replace(/\\D/g, "").slice(0, 1);
+        }).join("");
+      }
+      function fillLocalOtpCells(value) {
+        var digits = String(value || "").replace(/\\D/g, "").slice(0, 6);
+        var cells = Array.prototype.slice.call(document.querySelectorAll("[data-otp-cell]"));
+        cells.forEach(function (cell, index) { cell.value = digits.charAt(index) || ""; });
+        var focusIndex = Math.min(digits.length, cells.length - 1);
+        if (cells[focusIndex]) cells[focusIndex].focus();
+      }
+      function bindLocalOtpCells() {
+        var cells = Array.prototype.slice.call(document.querySelectorAll("[data-otp-cell]"));
+        cells.forEach(function (cell, index) {
+          cell.oninput = function () {
+            var value = String(cell.value || "").replace(/\\D/g, "");
+            if (value.length > 1) { fillLocalOtpCells(value); return; }
+            cell.value = value;
+            if (value && cells[index + 1]) cells[index + 1].focus();
+          };
+          cell.onkeydown = function (event) {
+            if (event.key === "Backspace" && !cell.value && cells[index - 1]) cells[index - 1].focus();
+          };
+          cell.onpaste = function (event) {
+            var text = event.clipboardData && event.clipboardData.getData ? event.clipboardData.getData("text") : "";
+            if (text) {
+              event.preventDefault();
+              fillLocalOtpCells(text);
+            }
+          };
+        });
+      }
       async function verifyLocalOtp() {
-        var otpInput = document.getElementById("localAuthOtp");
-        var otp = otpInput && otpInput.value ? String(otpInput.value).replace(/\\D/g, "") : "";
+        var otp = localOtpCellValues();
         if (otp.length !== 6) { setLocalAuthStatus("Enter the 6-digit code.", "error"); return; }
         var button = document.getElementById("localAuthVerify");
         if (button) { button.disabled = true; button.textContent = "Verifying..."; }
@@ -285,8 +379,7 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
             renderLocalPassphrase(data.mode || "unlock", data.email || localAuthEmail);
             return;
           }
-          connected = true;
-          await waitForStats();
+          await finishLocalLogin();
         } catch (error) {
           if (button) { button.disabled = false; button.textContent = "Verify code"; }
           setLocalAuthStatus(error && error.message ? error.message : "Could not verify the code.", "error");
@@ -300,19 +393,19 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
         setExtractMode(false);
         setReadyMode(true);
         setHead(setupMode ? "Create encrypted vault" : "Unlock encrypted vault", "Local passphrase");
-        app.className = "localAuthStage";
+        app.className = "localAuthStage localAuthWelcomeStage localAuthPassphraseStage";
         app.innerHTML =
-          '<section class="localAuthCard localAuthCardPassphrase">' +
-            '<div class="localAuthLead">' +
-              '<img src="/hud-assets/echo-face-cutout.png" alt="" />' +
-              '<p class="consentEyebrow">Encryption passphrase</p>' +
-              '<h2 class="siteHeadline">' + (setupMode ? 'Create your local vault passphrase.' : 'Enter your vault passphrase.') + '</h2>' +
+          '<section class="localAuthWelcome localAuthPassphraseWelcome">' +
+            '<div class="localAuthOrbScene" aria-hidden="true"><span class="localAuthOrb"></span><span class="localAuthOrbShadow"></span></div>' +
+            '<div class="localAuthWelcomeCopy">' +
+              '<h2>' + (setupMode ? 'Create your local vault passphrase.' : 'Enter your vault passphrase.') + '</h2>' +
               '<p>' + (setupMode ? 'Echo derives your encryption key on this device. The passphrase and key are never sent to EchoMem. If you forget it, encrypted memories cannot be recovered.' : 'Echo verifies this passphrase locally against your account encryption token. The passphrase is never sent to EchoMem.') + '</p>' +
             '</div>' +
-            '<form class="localAuthForm" id="localAuthPassphraseForm">' +
+            '<form class="localAuthWelcomeForm localAuthPassphraseForm" id="localAuthPassphraseForm">' +
               '<label class="localAuthField"><span>Passphrase</span><input id="localAuthPassphrase" type="password" autocomplete="' + (setupMode ? "new-password" : "current-password") + '" placeholder="Encryption passphrase" /></label>' +
               (setupMode ? '<label class="localAuthField"><span>Confirm passphrase</span><input id="localAuthPassphraseConfirm" type="password" autocomplete="new-password" placeholder="Confirm passphrase" /></label>' : '') +
-              '<div class="localAuthActions"><button class="primary" id="localAuthUnlock" type="submit">' + (setupMode ? "Create vault" : "Unlock") + '</button><button class="textButton" id="localAuthRestart" type="button">Use a different email</button></div>' +
+              '<button class="primary localAuthPassphraseSubmit" id="localAuthUnlock" type="submit">' + (setupMode ? "Create vault" : "Unlock") + '</button>' +
+              '<button class="secondary localAuthBackWide" id="localAuthRestart" type="button">Use a different email</button>' +
               '<p class="localAuthStatus' + (message ? " is-error" : "") + '" id="localAuthStatus" role="status" aria-live="polite">' + esc(message || "") + '</p>' +
             '</form>' +
           '</section>';
@@ -335,8 +428,7 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
         setLocalAuthStatus(setupMode ? "Creating encrypted vault..." : "Unlocking vault...");
         try {
           await postJson("/local-auth/passphrase", { passphrase: passphrase }, 30000);
-          connected = true;
-          await waitForStats();
+          await finishLocalLogin();
         } catch (error) {
           if (button) { button.disabled = false; button.textContent = setupMode ? "Create vault" : "Unlock"; }
           var msg = error && error.message ? error.message : "Could not unlock encrypted memory.";
@@ -350,6 +442,7 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
           return;
         }
         if (connected) { void waitForStats(); return; }
+        rememberSetupPlanChoice("");
         renderLocalLogin("");
       }
       function bindConnect() {