@marsnme/mcp-gateway 0.1.7 → 0.2.0

package/README.md

@@ -64,6 +64,22 @@ curl -sS http://127.0.0.1:18790/mcp \
   -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
 ```
 
+## Deployment safety gate (before restart)
+For upgrades, run database migrations with an explicit DDL-capable role and gate schema compatibility before restarting services.
+
+Recommended role guidance:
+- Use a role that can execute DDL on target schemas.
+- On Supabase-hosted Postgres this is typically `supabase_admin` (not `postgres`).
+
+Schema gate command:
+```bash
+bash deploy/phase2/pre_deploy_schema_gate.sh \
+  --db-url "<postgres://supabase_admin:<password>@<host>:5432/postgres>" \
+  --profiles coco,toto \
+  --expected-role supabase_admin
+```
+- If gate exits non-zero, stop deployment and do not restart services.
+
 ## Database setup and full onboarding
 For migrations and full setup details:
 - Repository README: https://github.com/Marsmanleo/MarsNMe/blob/main/README.md

package/deploy/phase2/pre_deploy_schema_gate.sh

@@ -0,0 +1,186 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DB_URL="${SUPABASE_DB_URL:-}"
+PROFILES="coco,toto"
+EXPECTED_ROLE="${MIGRATION_EXPECTED_ROLE:-supabase_admin}"
+SKIP_ROLE_CHECK="false"
+
+usage() {
+  cat <<EOF
+usage: $0 --db-url <postgres-url> [--profiles <comma-separated>] [--expected-role <role>] [--skip-role-check]
+
+examples:
+  $0 --db-url "<postgres-connection-string>"
+  $0 --db-url "<postgres-connection-string>" --profiles coco,toto --expected-role supabase_admin
+  $0 --db-url "<postgres-connection-string>" --profiles profile-a --expected-role app_owner
+  $0 --db-url "<postgres-connection-string>" --profiles profile-a --skip-role-check
+
+notes:
+  - run this gate before any service restart in deployment flow
+  - exit code 0 means schema is compatible with current gateway code
+  - exit code 1 means compatibility gate failed (do NOT restart)
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --db-url)
+      DB_URL="$2"
+      shift 2
+      ;;
+    --profiles)
+      PROFILES="$2"
+      shift 2
+      ;;
+    --expected-role)
+      EXPECTED_ROLE="$2"
+      shift 2
+      ;;
+    --skip-role-check)
+      SKIP_ROLE_CHECK="true"
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown arg: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+if ! command -v psql >/dev/null 2>&1; then
+  echo "psql not found in PATH; install PostgreSQL client tools first" >&2
+  exit 2
+fi
+
+if [[ -z "${DB_URL}" ]]; then
+  echo "--db-url is required (or set SUPABASE_DB_URL env)" >&2
+  exit 2
+fi
+
+escape_sql_literal() {
+  printf "%s" "$1" | sed "s/'/''/g"
+}
+
+quote_ident() {
+  local raw="$1"
+  printf '"%s"' "${raw//\"/\"\"}"
+}
+
+run_sql() {
+  local sql="$1"
+  psql "${DB_URL}" --set ON_ERROR_STOP=1 --no-psqlrc --tuples-only --no-align --quiet -c "${sql}"
+}
+
+PASS_COUNT=0
+FAIL_COUNT=0
+
+log_pass() {
+  printf '[PASS] %s\n' "$1"
+  PASS_COUNT=$((PASS_COUNT + 1))
+}
+
+log_fail() {
+  printf '[FAIL] %s\n' "$1" >&2
+  FAIL_COUNT=$((FAIL_COUNT + 1))
+}
+
+check_sql() {
+  local label="$1"
+  local sql="$2"
+  local output
+  if output="$(run_sql "${sql}" 2>&1)"; then
+    log_pass "${label}"
+    return
+  fi
+  output="$(printf '%s' "${output}" | tr '\n' ' ' | sed -E 's/[[:space:]]+/ /g')"
+  log_fail "${label} :: ${output}"
+}
+
+PROFILE_LIST=()
+IFS=',' read -ra RAW_PROFILES <<< "${PROFILES}"
+for raw_profile in "${RAW_PROFILES[@]}"; do
+  profile="$(printf '%s' "${raw_profile}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+  if [[ -z "${profile}" ]]; then
+    continue
+  fi
+  if [[ ! "${profile}" =~ ^[a-z][a-z0-9_-]*$ ]]; then
+    echo "invalid profile id: ${profile} (must match ^[a-z][a-z0-9_-]*$)" >&2
+    exit 2
+  fi
+  PROFILE_LIST+=("${profile}")
+done
+
+if [[ ${#PROFILE_LIST[@]} -eq 0 ]]; then
+  echo "no valid profiles found from --profiles input: ${PROFILES}" >&2
+  exit 2
+fi
+
+CURRENT_ROLE="$(run_sql "SELECT current_user;" | tr -d '[:space:]')"
+if [[ -z "${CURRENT_ROLE}" ]]; then
+  echo "failed to resolve current_user from database" >&2
+  exit 2
+fi
+
+printf '[INFO] pre-deploy schema gate start\n'
+printf '[INFO] target profiles=%s\n' "$(IFS=,; printf '%s' "${PROFILE_LIST[*]}")"
+printf '[INFO] connected role=%s\n' "${CURRENT_ROLE}"
+
+if [[ "${SKIP_ROLE_CHECK}" == "true" ]]; then
+  printf '[INFO] migration role check skipped by --skip-role-check\n'
+elif [[ -n "${EXPECTED_ROLE}" ]]; then
+  expected_role_lit="$(escape_sql_literal "${EXPECTED_ROLE}")"
+  role_status="$(run_sql "SELECT CASE WHEN current_user = '${expected_role_lit}' OR pg_has_role(current_user, '${expected_role_lit}', 'member') THEN 'ok' ELSE 'mismatch' END;" | tr -d '[:space:]' || true)"
+  if [[ "${role_status}" == "ok" ]]; then
+    log_pass "migration role check (expected=${EXPECTED_ROLE})"
+  else
+    log_fail "migration role check failed (expected=${EXPECTED_ROLE}, got=${CURRENT_ROLE})"
+  fi
+else
+  printf '[INFO] migration role check disabled (empty expected role)\n'
+fi
+
+for profile in "${PROFILE_LIST[@]}"; do
+  profile_lit="$(escape_sql_literal "${profile}")"
+  profile_ident="$(quote_ident "${profile}")"
+
+  check_sql "${profile}.memories required columns" \
+    "SELECT id,body,source,session_id,tags,agent_body,environment,promoted,promoted_at,created_at,expires_at FROM ${profile_ident}.memories LIMIT 0;"
+
+  check_sql "${profile}.marsvault_chunks required columns" \
+    "SELECT id,content,source_file,section,body,visibility,tags,type,date,origin,source_memory_id,source_session_id,source_tool,source_user_note,agent_body,environment,created_at,updated_at FROM ${profile_ident}.marsvault_chunks LIMIT 0;"
+
+  check_sql "${profile}.memories DDL ownership check" \
+    "DO \$\$ DECLARE owner_oid oid; BEGIN SELECT c.relowner INTO owner_oid FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = '${profile_lit}' AND c.relname = 'memories' AND c.relkind = 'r'; IF owner_oid IS NULL THEN RAISE EXCEPTION 'table %.% is missing', '${profile_lit}', 'memories'; END IF; IF NOT ((SELECT rolsuper FROM pg_roles WHERE rolname = current_user) OR owner_oid = (SELECT oid FROM pg_roles WHERE rolname = current_user) OR pg_has_role(current_user, owner_oid, 'MEMBER')) THEN RAISE EXCEPTION 'current_user % cannot ALTER %.memories (owner=%)', current_user, '${profile_lit}', pg_get_userbyid(owner_oid); END IF; END \$\$;"
+
+  check_sql "${profile}.marsvault_chunks DDL ownership check" \
+    "DO \$\$ DECLARE owner_oid oid; BEGIN SELECT c.relowner INTO owner_oid FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = '${profile_lit}' AND c.relname = 'marsvault_chunks' AND c.relkind = 'r'; IF owner_oid IS NULL THEN RAISE EXCEPTION 'table %.% is missing', '${profile_lit}', 'marsvault_chunks'; END IF; IF NOT ((SELECT rolsuper FROM pg_roles WHERE rolname = current_user) OR owner_oid = (SELECT oid FROM pg_roles WHERE rolname = current_user) OR pg_has_role(current_user, owner_oid, 'MEMBER')) THEN RAISE EXCEPTION 'current_user % cannot ALTER %.marsvault_chunks (owner=%)', current_user, '${profile_lit}', pg_get_userbyid(owner_oid); END IF; END \$\$;"
+
+  check_sql "${profile}.search_memories_semantic(v2) exists" \
+    "DO \$\$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace WHERE n.nspname = '${profile_lit}' AND p.proname = 'search_memories_semantic' AND p.pronargs = 7) THEN RAISE EXCEPTION 'missing function %.search_memories_semantic(text, integer, text, boolean, text, text, text)', '${profile_lit}'; END IF; END \$\$;"
+
+  check_sql "${profile}.search_marsvault_chunks_semantic(v2) exists" \
+    "DO \$\$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace WHERE n.nspname = '${profile_lit}' AND p.proname = 'search_marsvault_chunks_semantic' AND p.pronargs = 10) THEN RAISE EXCEPTION 'missing function %.search_marsvault_chunks_semantic(text, integer, text, boolean, boolean, boolean, text, text, text, text)', '${profile_lit}'; END IF; END \$\$;"
+done
+
+LATEST_MIGRATION_VERSION="$(run_sql "SELECT version FROM supabase_migrations.schema_migrations ORDER BY version DESC LIMIT 1;" 2>/dev/null | tr -d '[:space:]' || true)"
+if [[ -n "${LATEST_MIGRATION_VERSION}" ]]; then
+  printf '[INFO] latest schema_migrations.version=%s\n' "${LATEST_MIGRATION_VERSION}"
+else
+  printf '[WARN] schema_migrations version not available (table missing or inaccessible)\n' >&2
+fi
+
+printf '[INFO] pre-deploy schema gate summary: pass=%d fail=%d\n' "${PASS_COUNT}" "${FAIL_COUNT}"
+
+if [[ "${FAIL_COUNT}" -gt 0 ]]; then
+  printf '[ERROR] schema gate failed; do NOT restart services until all checks pass\n' >&2
+  exit 1
+fi
+
+printf '[OK] schema gate passed; safe to continue deployment restart flow\n'

package/deploy/phase3/smoke_gate.sh

@@ -159,23 +159,99 @@ TOTO_TOOL_CALL_JSON="$(mcp_jsonrpc "${TOTO_URL}" '{"jsonrpc":"2.0","id":"toto-li
 
 COCO_CALL_CHECK="$(CALL_PAYLOAD="${COCO_TOOL_CALL_JSON}" node -e '
 const payload = JSON.parse(process.env.CALL_PAYLOAD || "{}");
-if (payload.error) throw new Error("tools/call error: " + JSON.stringify(payload.error));
+const clip = (value, max = 800) => {
+  const text = String(value ?? "");
+  return text.length > max ? text.slice(0, max) + "...(truncated)" : text;
+};
+const extractErrorText = (value) => {
+  if (value == null) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (Array.isArray(value)) return value.map(extractErrorText).filter(Boolean).join(" | ");
+  if (typeof value === "object") {
+    if (typeof value.message === "string" && value.message) return value.message;
+    if (typeof value.error === "string" && value.error) return value.error;
+    if (value.error) {
+      const nested = extractErrorText(value.error);
+      if (nested) return nested;
+    }
+    if (value.details) {
+      const details = extractErrorText(value.details);
+      if (details) return details;
+    }
+    return JSON.stringify(value);
+  }
+  return String(value);
+};
+if (payload.error) throw new Error("tools/call error: " + clip(JSON.stringify(payload.error)));
 const content = payload.result?.content;
 if (!Array.isArray(content) || content.length === 0) throw new Error("tools/call missing content");
-const text = content[0]?.text ?? "";
-const parsed = JSON.parse(text);
-if (parsed.ok !== true) throw new Error("list_memories response missing ok=true");
+const textItems = content
+  .map((item) => (typeof item?.text === "string" ? item.text.trim() : ""))
+  .filter(Boolean);
+if (payload.result?.isError === true) {
+  throw new Error("tools/call returned isError=true; detail=" + clip(textItems.join(" | ")));
+}
+const firstText = textItems[0] || "";
+let parsed;
+try {
+  parsed = JSON.parse(firstText);
+} catch (err) {
+  throw new Error("tools/call first content is not valid JSON: " + clip(firstText));
+}
+if (parsed.ok !== true) {
+  const inner = extractErrorText(parsed.error) || extractErrorText(parsed.details) || extractErrorText(parsed.message) || clip(JSON.stringify(parsed));
+  throw new Error("list_memories returned ok!=true; detail=" + clip(inner));
+}
 process.stdout.write(JSON.stringify({ count: parsed.count ?? null }));
 ')"
 
 TOTO_CALL_CHECK="$(CALL_PAYLOAD="${TOTO_TOOL_CALL_JSON}" node -e '
 const payload = JSON.parse(process.env.CALL_PAYLOAD || "{}");
-if (payload.error) throw new Error("tools/call error: " + JSON.stringify(payload.error));
+const clip = (value, max = 800) => {
+  const text = String(value ?? "");
+  return text.length > max ? text.slice(0, max) + "...(truncated)" : text;
+};
+const extractErrorText = (value) => {
+  if (value == null) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (Array.isArray(value)) return value.map(extractErrorText).filter(Boolean).join(" | ");
+  if (typeof value === "object") {
+    if (typeof value.message === "string" && value.message) return value.message;
+    if (typeof value.error === "string" && value.error) return value.error;
+    if (value.error) {
+      const nested = extractErrorText(value.error);
+      if (nested) return nested;
+    }
+    if (value.details) {
+      const details = extractErrorText(value.details);
+      if (details) return details;
+    }
+    return JSON.stringify(value);
+  }
+  return String(value);
+};
+if (payload.error) throw new Error("tools/call error: " + clip(JSON.stringify(payload.error)));
 const content = payload.result?.content;
 if (!Array.isArray(content) || content.length === 0) throw new Error("tools/call missing content");
-const text = content[0]?.text ?? "";
-const parsed = JSON.parse(text);
-if (parsed.ok !== true) throw new Error("list_memories response missing ok=true");
+const textItems = content
+  .map((item) => (typeof item?.text === "string" ? item.text.trim() : ""))
+  .filter(Boolean);
+if (payload.result?.isError === true) {
+  throw new Error("tools/call returned isError=true; detail=" + clip(textItems.join(" | ")));
+}
+const firstText = textItems[0] || "";
+let parsed;
+try {
+  parsed = JSON.parse(firstText);
+} catch (err) {
+  throw new Error("tools/call first content is not valid JSON: " + clip(firstText));
+}
+if (parsed.ok !== true) {
+  const inner = extractErrorText(parsed.error) || extractErrorText(parsed.details) || extractErrorText(parsed.message) || clip(JSON.stringify(parsed));
+  throw new Error("list_memories returned ok!=true; detail=" + clip(inner));
+}
 process.stdout.write(JSON.stringify({ count: parsed.count ?? null }));
 ')"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marsnme/mcp-gateway",
-  "version": "0.1.7",
+"version": "0.2.0",
   "mcpName": "io.github.Marsmanleo/marsnme",
   "private": false,
   "description": "Agent-agnostic, LLM-agnostic memory backend for MCP-compatible tools",
@@ -26,7 +26,8 @@
     "session-memory",
     "cross-session",
     "llm",
-    "symbiosis"
+    "symbiosis",
+    "perplexity"
   ],
   "bin": {
     "marsnme": "server.mjs"

package/server.mjs

@@ -2,6 +2,7 @@
 import http from 'node:http';
 import crypto from 'node:crypto';
 import { execFileSync } from 'node:child_process';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 
@@ -171,6 +172,28 @@ if (!Number.isInteger(PORT) || PORT < 1 || PORT > 65535) {
   throw new Error(`Invalid PORT: ${PORT_RAW || String(PORT)}. Must be an integer between 1 and 65535.`);
 }
 const SUPABASE_BASE_URL = process.env.SUPABASE_BASE_URL || 'http://127.0.0.1:8100';
+const SUPABASE_AUTH_MODE_VALUES = new Set(['service', 'anon', 'hybrid']);
+const SUPABASE_AUTH_MODE_RAW = String(process.env.MCP_SUPABASE_AUTH_MODE || 'service')
+  .trim()
+  .toLowerCase();
+if (SUPABASE_AUTH_MODE_RAW && !SUPABASE_AUTH_MODE_VALUES.has(SUPABASE_AUTH_MODE_RAW)) {
+  console.warn(
+    `[config] invalid MCP_SUPABASE_AUTH_MODE=${SUPABASE_AUTH_MODE_RAW}; fallback to service`
+  );
+}
+const SUPABASE_AUTH_MODE = SUPABASE_AUTH_MODE_VALUES.has(SUPABASE_AUTH_MODE_RAW)
+  ? SUPABASE_AUTH_MODE_RAW
+  : 'service';
+const SUPABASE_ANON_KEY = String(process.env.SUPABASE_ANON_KEY || '').trim();
+const ANON_ALLOWED_TOOL_NAMES = new Set([
+  'list_memories',
+  'search_memories',
+  'reload_source_registry',
+  'recall',
+  'health_check',
+  'explain_memory'
+]);
+const SUPABASE_REQUEST_CONTEXT = new AsyncLocalStorage();
 const OAUTH_ENABLED = process.env.MCP_OAUTH_ENABLED !== 'false';
 const REQUIRE_BEARER = process.env.MCP_REQUIRE_BEARER === 'true';
 const BYPASS_BEARER_FOR_PRIVATE = process.env.MCP_BYPASS_BEARER_FOR_PRIVATE !== 'false';
@@ -711,11 +734,52 @@ function buildTools() {
         required: ['id'],
         additionalProperties: false
       }
+    },
+    {
+      name: 'batch_promote',
+      description: `Auto-promote expiring short memories to long-term ${DB_PROFILE}.marsvault_chunks. Finds candidates via health check scoring, ingests content, marks promoted.`,
+      inputSchema: {
+        type: 'object',
+        properties: {
+          alert_window_hours: {
+            type: 'number',
+            minimum: 1,
+            maximum: 720,
+            default: 48,
+            description: 'Look-ahead window for expiring memories (hours)'
+          },
+          max_promote: {
+            type: 'number',
+            minimum: 1,
+            maximum: 50,
+            default: 10,
+            description: 'Maximum memories to promote in one batch'
+          },
+          dry_run: {
+            type: 'boolean',
+            default: false,
+            description: 'If true, list candidates without promoting'
+          },
+          memory_ids: {
+            type: 'array',
+            items: { type: 'string' },
+            maxItems: 50,
+            description: 'Optional explicit memory IDs to promote (skips auto-detection)'
+          },
+          origin: {
+            type: 'string',
+            description: 'Origin marker for promoted chunks',
+            default: 'batch-promote'
+          }
+        },
+        additionalProperties: false
+      }
     }
   ];
 }
 
 const TOOLS = buildTools();
+const TOOL_BY_NAME = new Map(TOOLS.map((tool) => [tool.name, tool]));
 
 const OAUTH_CLIENTS = new Map();
 const OAUTH_CODES = new Map();
@@ -876,7 +940,15 @@ function getServiceKey() {
   );
 }
 
-const SERVICE_KEY = getServiceKey();
+const SERVICE_KEY = SUPABASE_AUTH_MODE === 'anon' ? '' : getServiceKey();
+if (
+  (SUPABASE_AUTH_MODE === 'anon' || SUPABASE_AUTH_MODE === 'hybrid') &&
+  !SUPABASE_ANON_KEY
+) {
+  throw new Error(
+    'SUPABASE_ANON_KEY is required when MCP_SUPABASE_AUTH_MODE is anon or hybrid'
+  );
+}
 loadPersistedOauthClients();
 
 if (STATIC_CLIENT_ID && STATIC_CLIENT_SECRET && OAUTH_ENABLED) {
@@ -935,10 +1007,67 @@ async function readRequestBody(req) {
   }
 }
 
+function resolveSupabaseRequestAuthMode() {
+  const storeMode = String(SUPABASE_REQUEST_CONTEXT.getStore()?.db_auth_mode || '')
+    .trim()
+    .toLowerCase();
+  if (SUPABASE_AUTH_MODE_VALUES.has(storeMode)) {
+    return storeMode;
+  }
+  if (SUPABASE_AUTH_MODE === 'anon') {
+    return 'anon';
+  }
+  return 'service';
+}
+
+function isToolAllowedInAnonMode(toolName) {
+  return ANON_ALLOWED_TOOL_NAMES.has(String(toolName || '').trim());
+}
+
+function assertToolCapabilityForAuthMode(toolName) {
+  if (SUPABASE_AUTH_MODE !== 'anon') return;
+  if (isToolAllowedInAnonMode(toolName)) return;
+  throw new Error(
+    `capability_not_available_in_anon_mode: ${toolName} is disabled; use MCP_SUPABASE_AUTH_MODE=service or hybrid`
+  );
+}
+
+function resolveDbAuthModeForTool(toolName) {
+  if (SUPABASE_AUTH_MODE === 'anon') return 'anon';
+  if (SUPABASE_AUTH_MODE === 'service') return 'service';
+  return isToolAllowedInAnonMode(toolName) ? 'anon' : 'service';
+}
+function listAvailableToolNamesForAuthMode(authMode) {
+  if (authMode === 'anon') {
+    return TOOLS
+      .map((tool) => String(tool?.name || '').trim())
+      .filter((name) => name && isToolAllowedInAnonMode(name));
+  }
+  return TOOLS.map((tool) => String(tool?.name || '').trim()).filter(Boolean);
+}
+function listAvailableToolsForAuthMode(authMode) {
+  const names = listAvailableToolNamesForAuthMode(authMode);
+  return names
+    .map((name) => TOOL_BY_NAME.get(name))
+    .filter((tool) => Boolean(tool));
+}
+function buildSupabaseCapabilityPayload() {
+  return {
+    mode: SUPABASE_AUTH_MODE,
+    anon_allowed_tools: listAvailableToolNamesForAuthMode('anon'),
+    effective_tools: listAvailableToolNamesForAuthMode(SUPABASE_AUTH_MODE)
+  };
+}
+
 async function supabaseRequest(path, options = {}) {
+  const requestAuthMode = resolveSupabaseRequestAuthMode();
+  const requestApiKey = requestAuthMode === 'anon' ? SUPABASE_ANON_KEY : SERVICE_KEY;
+  if (!requestApiKey) {
+    throw new Error(`Supabase API key missing for auth mode: ${requestAuthMode}`);
+  }
   const headers = {
-    apikey: SERVICE_KEY,
-    Authorization: `Bearer ${SERVICE_KEY}`,
+    apikey: requestApiKey,
+    Authorization: `Bearer ${requestApiKey}`,
     'content-type': 'application/json'
   };
   if (options.profile) {
@@ -1455,7 +1584,10 @@ async function writeToolUsageTelemetry(payload = {}) {
     new Date().toISOString();
   const agentBody =
     normalizeOptionalAgentBody(payload.agent_body) || DB_PROFILE;
-  try {
+  if (SUPABASE_AUTH_MODE === 'anon') {
+    return;
+  }
+  const writeTelemetry = async () => {
     await supabaseRequest(
       `/rest/v1/memory_tool_usage?select=${TOOL_USAGE_INSERT_SELECT_COLUMNS}`,
       {
@@ -1473,6 +1605,13 @@ async function writeToolUsageTelemetry(payload = {}) {
         ]
       }
     );
+  };
+  try {
+    if (SUPABASE_AUTH_MODE === 'hybrid') {
+      await SUPABASE_REQUEST_CONTEXT.run({ db_auth_mode: 'service' }, writeTelemetry);
+    } else {
+      await writeTelemetry();
+    }
   } catch (error) {
     console.warn(
       `[telemetry] failed to persist memory_tool_usage: ${String(error?.message || error)}`
@@ -2717,6 +2856,156 @@ async function runHealthExpiryCheck(args = {}) {
   return payload;
 }
 
+async function runBatchPromote(args = {}) {
+  const alertWindowHours = clampInteger(args.alert_window_hours, 1, 720, 48);
+  const maxPromote = clampInteger(args.max_promote, 1, 50, 10);
+  const dryRun = Boolean(args.dry_run);
+  const origin = String(args.origin || 'batch-promote').trim() || 'batch-promote';
+  const explicitIds = Array.isArray(args.memory_ids)
+    ? args.memory_ids
+        .map((id) => normalizeOptionalUuid(id, 'memory_ids'))
+        .filter(Boolean)
+    : [];
+
+  const candidates = [];
+
+  if (explicitIds.length > 0) {
+    for (const memoryId of explicitIds.slice(0, maxPromote)) {
+      const memory = await fetchMemoryById(memoryId);
+      if (!memory) {
+        candidates.push({ id: memoryId, status: 'not_found', skipped: true });
+        continue;
+      }
+      if (memory.promoted || memory.promoted_at) {
+        candidates.push({
+          id: memoryId,
+          status: 'already_promoted',
+          skipped: true,
+          excerpt: String(memory.body || '').slice(0, 140)
+        });
+        continue;
+      }
+      candidates.push({
+        id: memoryId,
+        status: 'eligible',
+        skipped: false,
+        excerpt: String(memory.body || '').slice(0, 140),
+        tags: normalizeTags(memory.tags),
+        expires_at: memory.expires_at || null,
+        memory
+      });
+    }
+  } else {
+    const healthResult = await runHealthExpiryCheck({
+      alert_window_hours: alertWindowHours
+    });
+    const soonExpiring = healthResult?.expiry_alert?.soon_expiring || [];
+    const recommended = soonExpiring
+      .filter((item) => item.recommend_promote === 'Y')
+      .slice(0, maxPromote);
+
+    for (const item of recommended) {
+      const memory = await fetchMemoryById(item.id);
+      if (!memory) {
+        candidates.push({ id: item.id, status: 'not_found', skipped: true });
+        continue;
+      }
+      candidates.push({
+        id: item.id,
+        status: 'eligible',
+        skipped: false,
+        excerpt: item.excerpt || String(memory.body || '').slice(0, 140),
+        tags: item.tags || normalizeTags(memory.tags),
+        expires_at: item.expires_at || memory.expires_at || null,
+        recommendation_reason: item.recommendation_reason || null,
+        memory
+      });
+    }
+  }
+
+  const eligible = candidates.filter((c) => !c.skipped);
+
+  if (dryRun) {
+    return {
+      ok: true,
+      dry_run: true,
+      profile: DB_PROFILE,
+      origin,
+      alert_window_hours: alertWindowHours,
+      max_promote: maxPromote,
+      total_candidates: candidates.length,
+      eligible_count: eligible.length,
+      skipped_count: candidates.length - eligible.length,
+      candidates: candidates.map(({ memory, ...rest }) => rest)
+    };
+  }
+
+  const promoted = [];
+  const errors = [];
+
+  for (const candidate of eligible) {
+    try {
+      const memory = candidate.memory;
+      const content = String(memory.body || '').trim();
+      if (!content) {
+        errors.push({ id: candidate.id, error: 'empty memory body' });
+        continue;
+      }
+
+      const ingestResult = await ingestMarsvaultChunks(
+        {
+          content,
+          tags: normalizeTags(memory.tags),
+          source_memory_id: memory.id,
+          source_session_id: memory.session_id || null,
+          source_tool: memory.source || null,
+          origin
+        },
+        {
+          defaultType: 'insight',
+          defaultSourceFile: PROFILE.memoryIngestDefaultSourceFile,
+          defaultSectionPrefix: 'batch-promote',
+          defaultOrigin: origin,
+          body: DB_PROFILE,
+          fixedTags: [...PROFILE.memoryIngestFixedTags, 'batch-promote']
+        }
+      );
+
+      const promotedMemory = await markMemoryAsPromoted(memory.id);
+
+      promoted.push({
+        id: memory.id,
+        chunk_count: ingestResult.chunk_count || 0,
+        promoted_at: promotedMemory?.promoted_at || null,
+        excerpt: String(content).slice(0, 140)
+      });
+    } catch (error) {
+      errors.push({
+        id: candidate.id,
+        error: normalizeOptionalText(error?.message || String(error), 280)
+      });
+    }
+  }
+
+  return {
+    ok: true,
+    dry_run: false,
+    profile: DB_PROFILE,
+    origin,
+    alert_window_hours: alertWindowHours,
+    max_promote: maxPromote,
+    total_candidates: candidates.length,
+    promoted_count: promoted.length,
+    error_count: errors.length,
+    skipped_count: candidates.length - eligible.length,
+    promoted,
+    errors: errors.length > 0 ? errors : undefined,
+    skipped: candidates
+      .filter((c) => c.skipped)
+      .map(({ memory, ...rest }) => rest)
+  };
+}
+
 async function runHealthCheck(args = {}) {
   const alertWindowHours = clampInteger(args.alert_window_hours, 1, 720, 48);
   const gapDays = clampInteger(args.gap_days, 7, 365, 30);
@@ -3620,6 +3909,9 @@ async function callTool(name, args = {}) {
       };
     }
 
+    if (toolName === 'batch_promote') {
+      return await runBatchPromote(args);
+    }
     if (toolName === 'health_check') {
       return await runHealthCheck(args);
     }
@@ -4237,6 +4529,8 @@ const server = http.createServer(async (req, res) => {
       embedding_provider: 'jina',
       embedding_model: JINA_EMBEDDING_MODEL,
       embedding_enabled: Boolean(JINA_API_KEY),
+      supabase_auth_mode: SUPABASE_AUTH_MODE,
+      supabase_capabilities: buildSupabaseCapabilityPayload(),
       source_mode: SOURCE_MODE,
       memory_sources: MEMORY_SOURCE_LIST.slice(),
       extra_sources: EXTRA_SOURCE_LIST.slice(),
@@ -4318,14 +4612,24 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (method === 'tools/list') {
-      json(res, 200, mcpResult(id, { tools: TOOLS }));
+      json(
+        res,
+        200,
+        mcpResult(id, { tools: listAvailableToolsForAuthMode(SUPABASE_AUTH_MODE) })
+      );
       return;
     }
 
     if (method === 'tools/call') {
-      const toolName = rpc?.params?.name;
+      const requestedToolName = rpc?.params?.name;
+      const toolName = resolveToolName(requestedToolName);
+      assertToolCapabilityForAuthMode(toolName);
+      const dbAuthMode = resolveDbAuthModeForTool(toolName);
       const args = rpc?.params?.arguments ?? {};
-      const result = await callTool(toolName, args);
+      const result = await SUPABASE_REQUEST_CONTEXT.run(
+        { db_auth_mode: dbAuthMode },
+        async () => await callTool(toolName, args)
+      );
       json(
         res,
         200,