@nxuss/lemma 0.7.9 → 0.8.1

package/README.md

@@ -1,11 +1,11 @@
-# 🧠 Lemma v0.7.8
+# 🧠 Lemma v0.8.1
 
 [![npm version](https://img.shields.io/npm/v/@nxuss/lemma.svg?color=orange&style=flat-square)](https://www.npmjs.com/package/@nxuss/lemma)
 [![License](https://img.shields.io/npm/l/@nxuss/lemma.svg?color=blue&style=flat-square)](https://github.com/Nxusbets/lemma/blob/main/LICENSE)
 [![Build Status](https://img.shields.io/badge/tests-139%20passed-brightgreen.svg?style=flat-square)](https://github.com/Nxusbets/lemma)
 [![Security](https://img.shields.io/badge/privacy-firewall%20active-blueviolet?style=flat-square)](https://github.com/Nxusbets/lemma)
 [![Caching](https://img.shields.io/badge/semantic%20memory-enabled-success?style=flat-square)](https://github.com/Nxusbets/lemma)
-[![MCP Tools](https://img.shields.io/badge/MCP%20tools-21-ff69b4?style=flat-square)](https://github.com/Nxusbets/lemma)
+[![MCP Tools](https://img.shields.io/badge/MCP%20tools-25-ff69b4?style=flat-square)](https://github.com/Nxusbets/lemma)
 
 ```text
     __                                
@@ -154,9 +154,9 @@ Create or edit `lemma.config.json` in your project root to disable or fine-tune
 
 ---
 
-## 🛠️ MCP Tools Reference (v0.7.8 — 21 Tools)
+## 🛠️ MCP Tools Reference (v0.8.0 — 25 Tools)
 
-When connected via `lemma mcp`, your Chat IDE gains access to **21 native tools** covering workspace navigation, code safety, semantic memory, AI cost optimization, and autonomous project context injection.
+When connected via `lemma mcp`, your Chat IDE gains access to **25 native tools** covering workspace navigation, code safety, semantic memory, AI cost optimization, autonomous project context injection, and TurboMode optimization.
 
 ### 🗂️ Workspace Tools
 
@@ -198,6 +198,32 @@ When connected via `lemma mcp`, your Chat IDE gains access to **21 native tools*
 | `get_routing_advice` | Analyze a prompt and get the optimal model recommendation from the Complexity Router. |
 | `auto_heal` | Diagnose and auto-heal the latest local server crash from Lemma's live context logs. |
 | `get_project_onboarding` | Download a one-shot architectural mental model of the current project codebase. |
+| `turbosqueeze` | Extreme prompt compression — strips comments, imports, whitespace, compacts JSON. |
+| `compress_context` | Summarize old conversation turns via Ollama (fallback: truncation). |
+| `smarter_cache` | Predictive cache — queries The Brain at 75% threshold before reasoning. |
+| `token_budget` | Optimization dashboard with multiplier, savings, and recommendations. |
+
+### 🚀 TurboMode Tools (NEW in v0.8.0)
+
+| Tool | Description |
+| :--- | :--- |
+| `turbosqueeze` | **Extreme prompt compression.** Strips comments, imports, whitespace, and compacts JSON. Returns reduction stats and reports savings to proxy ledger. |
+| `compress_context` | **Conversation summarization.** Summarizes old turns via Ollama (falls back to truncation), keeps last N turns intact, reports token savings. |
+| `smarter_cache` | **Predictive cache.** Queries The Brain at 75% threshold before any reasoning, auto-suggests `store_memory` on MISS. |
+| `token_budget` | **Optimization dashboard.** Displays current multiplier, tokens saved, tool calls, and optimization recommendations. |
+
+### ⚡ TurboMode Auto-Injection
+When connected via `lemma mcp`, Lemma automatically injects 7 TurboMode rules into the agent's system prompt during handshake — no manual prompt loading required:
+1. `turbosqueeze` before writing code
+2. `smarter_cache` before any reasoning
+3. `compress_context` every turn
+4. `store_memory` after every solution
+5. `get_ast_hologram` before reading files
+6. `batch_tool_calls` for parallel operations
+7. No fluff or chit-chat
+
+### 📡 Dashboard MCP Toggle
+The Dashboard Header now shows a **clickable MCP status badge** — click to enable/disable MCP integration instantly. The badge cycles through `active` (cyan), `idle` (gray), and `offline` (red) states.
 
 ### 📡 MCP Resources
 
@@ -252,7 +278,7 @@ For **Lemma Pro** users, expose Lemma's entire intelligence layer — Privacy Fi
    * **Name**: `Lemma`
    * **Type**: `command`
    * **Command**: `lemma mcp`
-4. Click **Save**. A green **"Connected"** dot will appear, confirming that the IDE has loaded all 21 of Lemma's tools.
+4. Click **Save**. A green **"Connected"** dot will appear, confirming that the IDE has loaded all 25 of Lemma's tools.
 
 #### 🟢 Claude Desktop:
 Add the following to your `claude_desktop_config.json` configuration file:
@@ -276,4 +302,59 @@ Add the following to your `claude_desktop_config.json` configuration file:
 
 ---
 
+## 🔒 Security & Privacy
+
+### Network Binding
+By default, Lemma binds only to `127.0.0.1` (localhost). It is **not accessible from the network** unless you explicitly set:
+```env
+LEMMA_BIND_HOST=0.0.0.0
+```
+> ⚠️ If you do expose Lemma to the network, always enable authentication first:
+> ```env
+> AUTH_ENABLED=true
+> AUTH_REQUIRE_API_KEY=true
+> AUTH_ALLOWED_ORIGINS=https://yourdomain.com
+> ```
+
+### 📋 Clipboard Watcher Disclosure
+The **Clipboard Telepathic Watcher** polls your system clipboard every 1 second to automatically compress code you copy. This is disclosed in the startup banner. To disable it:
+```env
+# In your .env
+LEMMA_DISABLE_CLIPBOARD=true
+```
+Or via CLI flag: `lemma start --no-clipboard`
+
+### MCP Command Allowlist
+The `run_workspace_command` MCP tool only executes commands from an allowlist. Default safe prefixes include `npm`, `npx`, `git`, `tsc`, `node`, `jest`, `eslint`, `ls`, `grep`, and more.
+
+To extend the allowlist for your project, add to `lemma.config.json`:
+```json
+{
+  "mcp": {
+    "allowedCommandPrefixes": ["your-tool", "another-cmd"]
+  }
+}
+```
+
+### License Security (Cloud Server)
+When running the cloud server in production, set a private license salt:
+```env
+# Generate with: openssl rand -hex 32
+LEMMA_LICENSE_SALT=your-random-64-char-hex-string
+```
+
+### Stripe Webhooks (Cloud Server)
+The Stripe webhook endpoint requires a webhook signing secret in production:
+```env
+STRIPE_WEBHOOK_SECRET=whsec_...
+```
+Get this from **Stripe Dashboard → Developers → Webhooks → Signing Secret**. Without it, the endpoint is disabled in `NODE_ENV=production`.
+
+For local testing: `STRIPE_SKIP_SIGNATURE_VERIFY=true`
+
+### Full Security Template
+See [`.env.security.example`](.env.security.example) for all security-related environment variables.
+
+---
+
 MIT © Nxus Studio | [Upgrade to Lemma Pro](https://lemma.nxus.studio/upgrade)

package/dist/cjs/cli/lemma-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lemma-proxy.d.ts","sourceRoot":"","sources":["../../../src/cli/lemma-proxy.ts"],"names":[],"mappings":";AAqZA,wBAAgB,+BAA+B,CAAC,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA4DvF;AAkiED,wBAAsB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6KhL"}
+{"version":3,"file":"lemma-proxy.d.ts","sourceRoot":"","sources":["../../../src/cli/lemma-proxy.ts"],"names":[],"mappings":";AA0bA,wBAAgB,+BAA+B,CAAC,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA4DvF;AA2jED,wBAAsB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6KhL"}

package/dist/cjs/cli/lemma-proxy.js

@@ -14,6 +14,7 @@ const crypto_1 = __importDefault(require("crypto"));
 const chromadb_1 = require("chromadb");
 const https_1 = __importDefault(require("https"));
 const http_1 = __importDefault(require("http"));
+const os_1 = __importDefault(require("os"));
 const axios_1 = __importDefault(require("axios"));
 const readline_1 = __importDefault(require("readline"));
 function getVersion() {
@@ -54,7 +55,7 @@ const semanticScrubber = new SemanticScrubber_1.default();
 const cloudSync = new CloudSyncClient_1.default();
 const agentMultiplexer = new AgentMultiplexer_1.AgentMultiplexer();
 // ── Paths ──────────────────────────────────────────────────────────────────────
-const HOME = process.env.HOME || process.env.USERPROFILE || '~';
+const HOME = os_1.default.homedir();
 const CACHE_DIR = path_1.default.join(HOME, '.lemma-cache');
 const PID_FILE = path_1.default.join(CACHE_DIR, 'proxy.pid');
 const PORT_FILE = path_1.default.join(CACHE_DIR, 'proxy.port');
@@ -168,7 +169,7 @@ function autoConfigureAll(project, opts) {
         fs_1.default.mkdirSync(mcpDir, { recursive: true });
     }
     // Register lemma MCP server in Claude Desktop config
-    const claudeConfigDir = path_1.default.join(process.env.HOME || '~', 'Library', 'Application Support', 'Claude');
+    const claudeConfigDir = path_1.default.join(os_1.default.homedir(), 'Library', 'Application Support', 'Claude');
     const claudeConfigFile = path_1.default.join(claudeConfigDir, 'claude_desktop_config.json');
     if (fs_1.default.existsSync(claudeConfigDir)) {
         let claudeConfig = { mcpServers: {} };
@@ -194,7 +195,7 @@ function autoConfigureAll(project, opts) {
         }
     }
     // Register lemma MCP server in Cursor config
-    const cursorConfigDir = path_1.default.join(process.env.HOME || '~', '.cursor');
+    const cursorConfigDir = path_1.default.join(os_1.default.homedir(), '.cursor');
     const cursorConfigFile = path_1.default.join(cursorConfigDir, 'mcp.json');
     if (fs_1.default.existsSync(cursorConfigDir)) {
         let cursorConfig = { mcpServers: {} };
@@ -219,7 +220,7 @@ function autoConfigureAll(project, opts) {
         }
     }
     // Register lemma MCP server in Windsurf config
-    const windsurfConfigDir = path_1.default.join(process.env.HOME || '~', '.codeium', 'windsurf');
+    const windsurfConfigDir = path_1.default.join(os_1.default.homedir(), '.codeium', 'windsurf');
     const windsurfConfigFile = path_1.default.join(windsurfConfigDir, 'mcp_config.json');
     if (fs_1.default.existsSync(windsurfConfigDir)) {
         let windsurfConfig = { mcpServers: {} };
@@ -246,7 +247,7 @@ function autoConfigureAll(project, opts) {
     }
     // Register lemma MCP server in Kiro config
     const kiroDirs = [
-        path_1.default.join(process.env.HOME || '~', '.kiro', 'settings'),
+        path_1.default.join(os_1.default.homedir(), '.kiro', 'settings'),
         path_1.default.join(process.cwd(), '.kiro', 'settings'),
     ];
     for (const kiroDir of kiroDirs) {
@@ -318,7 +319,7 @@ function autoConfigureAll(project, opts) {
         catch { }
     }
     // Register lemma MCP server in Codex CLI config (~/.codex/config.toml)
-    const codexConfigFile = path_1.default.join(process.env.HOME || '~', '.codex', 'config.toml');
+    const codexConfigFile = path_1.default.join(os_1.default.homedir(), '.codex', 'config.toml');
     const codexConfigDir = path_1.default.dirname(codexConfigFile);
     if (fs_1.default.existsSync(codexConfigDir)) {
         try {
@@ -339,6 +340,42 @@ enabled = true
         }
         catch { }
     }
+    // Register lemma MCP server in Claude Code Extension config (.mcp.json project scope)
+    const claudeMcpFile = path_1.default.join(process.cwd(), '.mcp.json');
+    if (!fs_1.default.existsSync(claudeMcpFile)) {
+        try {
+            const claudeConfig = {
+                mcpServers: {
+                    lemma: {
+                        command: 'npx',
+                        args: ['-y', '@nxuss/lemma', 'mcp'],
+                    },
+                },
+            };
+            fs_1.default.writeFileSync(claudeMcpFile, JSON.stringify(claudeConfig, null, 2));
+            console.log('✅ [Claude Code] Registered lemma MCP server in .mcp.json');
+        }
+        catch { }
+    }
+    // Register lemma MCP server in Claude Code user config (~/.claude.json user scope)
+    const claudeUserMcpFile = path_1.default.join(os_1.default.homedir(), '.claude.json');
+    try {
+        let claudeUserConfig = {};
+        if (fs_1.default.existsSync(claudeUserMcpFile)) {
+            claudeUserConfig = JSON.parse(fs_1.default.readFileSync(claudeUserMcpFile, 'utf8'));
+        }
+        if (!claudeUserConfig.mcpServers)
+            claudeUserConfig.mcpServers = {};
+        if (!claudeUserConfig.mcpServers.lemma) {
+            claudeUserConfig.mcpServers.lemma = {
+                command: 'npx',
+                args: ['-y', '@nxuss/lemma', 'mcp'],
+            };
+            fs_1.default.writeFileSync(claudeUserMcpFile, JSON.stringify(claudeUserConfig, null, 2));
+            console.log('✅ [Claude Code] Registered lemma MCP server in ~/.claude.json');
+        }
+    }
+    catch { }
     console.log(`✅ Auto-configured Lemma for [${project}]`);
 }
 const EVENT_LOG = [];
@@ -347,7 +384,8 @@ const MAX_EVENTS = 100;
 const MCP_STATUS = {
     lastActivity: Date.now(),
     toolCallCount: 0,
-    status: 'idle'
+    status: 'idle',
+    mcpEnabled: true,
 };
 function logEvent(event) {
     const ev = { id: Math.random().toString(36).slice(2, 11), timestamp: Date.now(), ...event };
@@ -980,12 +1018,20 @@ class LemmaServer {
             }
             res.json({
                 status,
+                enabled: MCP_STATUS.mcpEnabled,
                 lastActivity: new Date(MCP_STATUS.lastActivity).toISOString(),
                 toolCallCount: MCP_STATUS.toolCallCount,
                 secondsSinceActive: Math.floor(secondsSinceActive),
                 uptime: Math.floor(process.uptime())
             });
         });
+        // MCP Toggle endpoint
+        this.app.post('/api/mcp/toggle', (req, res) => {
+            MCP_STATUS.mcpEnabled = !MCP_STATUS.mcpEnabled;
+            const state = MCP_STATUS.mcpEnabled ? 'enabled' : 'disabled';
+            console.log(`🔄 [MCP] Toggled ${state}`);
+            res.json({ enabled: MCP_STATUS.mcpEnabled, status: state });
+        });
         // Project registration from MCP handshake
         this.app.post('/api/handshake', (req, res) => {
             const { projectPath, projectName, stack } = req.body;
@@ -1960,14 +2006,23 @@ Adjusted Answer:`;
             }
             throw e;
         });
-        server.listen(this.port, async () => {
+        const BIND_HOST = process.env.LEMMA_BIND_HOST || '127.0.0.1';
+        server.listen(this.port, BIND_HOST, async () => {
             fs_1.default.writeFileSync(PID_FILE, String(process.pid));
             fs_1.default.writeFileSync(PORT_FILE, String(this.port));
+            // Security warning if binding to all interfaces without auth
+            if (BIND_HOST !== '127.0.0.1' && BIND_HOST !== 'localhost') {
+                const authEnabled = process.env.AUTH_ENABLED === 'true';
+                if (!authEnabled) {
+                    console.warn(`\n\x1b[33m⚠️  [SECURITY] Lemma proxy is bound to ${BIND_HOST} (all interfaces) with AUTH_ENABLED=false.`);
+                    console.warn(`   Set AUTH_ENABLED=true and AUTH_REQUIRE_API_KEY=true before exposing to any network.\x1b[0m\n`);
+                }
+            }
             const pro = await isPro();
             console.log(`\x1b[1m\x1b[35m┌──────────────────────────────────────────────────────────┐\x1b[0m`);
             console.log(`\x1b[1m\x1b[35m│   🚀 LEMMA PROXY v${VERSION} — THE UNIVERSAL AI GATEWAY      │\x1b[0m`);
             console.log(`\x1b[1m\x1b[35m└──────────────────────────────────────────────────────────┘\x1b[0m`);
-            console.log(`\n📁 Project : ${this.projectName}\n🔌 Port    : ${this.port}`);
+            console.log(`\n📁 Project : ${this.projectName}\n🔌 Port    : ${this.port}  (bound to ${BIND_HOST})`);
             if (this.dashboardPath && fs_1.default.existsSync(this.dashboardPath)) {
                 console.log(`📊 Dashboard UI          : \x1b[36mhttp://localhost:${this.port}/dashboard/\x1b[0m`);
                 if (this.openBrowser) {
@@ -2006,12 +2061,19 @@ Adjusted Answer:`;
             console.log(`\n   \x1b[1m\x1b[33mlemma mcp\x1b[0m\n`);
             console.log('────────────────────────────────────────────────\n');
             // Auto-start the Local Clipboard Optimizer Watcher in the background
-            try {
-                const { startClipboardWatcher } = require('../utils/ClipboardWatcher');
-                startClipboardWatcher(1000);
+            const clipboardDisabled = process.env.LEMMA_DISABLE_CLIPBOARD === 'true';
+            if (clipboardDisabled) {
+                console.log(`📋 Clipboard Watcher     : \x1b[90m[DISABLED via LEMMA_DISABLE_CLIPBOARD]\x1b[0m`);
             }
-            catch (err) {
-                console.warn(`⚠️ Could not auto-initialize Clipboard Watcher: ${err.message}`);
+            else {
+                console.log(`📋 Clipboard Watcher     : \x1b[33m[ACTIVE]\x1b[0m — polling clipboard every 1s (disable: LEMMA_DISABLE_CLIPBOARD=true)`);
+                try {
+                    const { startClipboardWatcher } = require('../utils/ClipboardWatcher');
+                    startClipboardWatcher(1000);
+                }
+                catch (err) {
+                    console.warn(`⚠️ Could not auto-initialize Clipboard Watcher: ${err.message}`);
+                }
             }
         });
         process.on('SIGTERM', () => server.close());