local-model-suitability-mcp 1.1.23 → 1.1.25

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## [1.1.24] - 2026-06-26
+- fix: trial extension requests now written to Redis (lms:trial:{email}) on grant -- permanent audit trail that survives redeploys; previously in-memory only
+
 ## [1.1.23] - 2026-06-25
 - feat: calls_remaining field added to check_local_viability response -- "unlimited" for paid keys, numeric free-tier headroom otherwise (HTTP POST and stdio transports)
 - feat: verdict_ttl field added (86400s/24h)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "local-model-suitability-mcp",
   "mcpName": "io.github.OjasKord/local-model-suitability-mcp",
-  "version": "1.1.23",
+  "version": "1.1.25",
   "description": "AI model router for agents. Checks whether a local model can handle the task before calling cloud inference. LOCAL/CLOUD verdict saves cost on every call.",
   "main": "src/server.js",
   "type": "module",

package/src/server.js

@@ -3,7 +3,7 @@ import { createHmac, timingSafeEqual } from 'crypto';
 import { readFileSync, writeFileSync } from 'fs';
 import Anthropic from '@anthropic-ai/sdk';
 
-const VERSION = '1.1.23';
+const VERSION = '1.1.25';
 const FIRST_DEPLOYED = '2026-04-13T06:41:38Z';
 const LIFETIME_CALLS_REDIS_KEY = 'lms:lifetime_calls';
 const UPTIME_HEARTBEAT_KEY = 'lms:uptime:heartbeat_count';
@@ -24,7 +24,7 @@ function nowISO() { return new Date().toISOString(); }
 const cors = {
   'Access-Control-Allow-Origin': '*',
   'Access-Control-Allow-Methods': 'GET, POST, OPTIONS, HEAD',
-  'Access-Control-Allow-Headers': 'Content-Type, x-api-key, x-stats-key'
+  'Access-Control-Allow-Headers': 'Content-Type, x-api-key, x-stats-key, x-owner-key'
 };
 
 // ── Stats persistence ─────────────────────────────────────────────────────────
@@ -312,6 +312,7 @@ async function saveFreeTierToRedis() {
 
 // ── Anthropic client ──────────────────────────────────────────────────────────
 const anthropic = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
+const OWNER_KEY = process.env.OWNER_KEY || '';
 
 // ── Cloud pricing reference (approximate, per 1K tokens, mid-2026) ───────────
 const CLOUD_PRICING = {
@@ -715,6 +716,7 @@ const server = createServer(async (req, res) => {
         stats.free_tier_calls_by_ip[clientIp][month] = Math.max(0, current - TRIAL_EXTENSION_CALLS);
         trialExtensions.set(emailKey, { name, email, use_case: use_case || '', ip: clientIp, granted_at: nowISO() });
         saveStats();
+        await redisSet(REDIS_PREFIX + ':trial:' + email.toLowerCase().trim(), { name, email, use_case: use_case || '', ip: clientIp, timestamp: nowISO(), server: 'local-model-suitability-mcp' });
         // 24h follow-up record -- processed by /process-trial-followups (fleet cron)
         await redisSet(REDIS_PREFIX + ':followup:' + email.toLowerCase().trim(), { email, name, server: 'local-model-suitability-mcp', granted_at: nowISO(), sent: false });
         const sendTrialEmail = async (to, subject, html) => {
@@ -884,7 +886,12 @@ const server = createServer(async (req, res) => {
               result: { content: [{ type: 'text', text: JSON.stringify({ error: 'task is required — describe what you are about to send to the cloud model', likely_cause: 'required field missing or malformed', retryable: false, retry_after_ms: null, fallback_tool: null, agent_action: 'PROVIDE_REQUIRED_FIELD', category: 'invalid_input', trace_id: nowISO(), _disclaimer: LEGAL_DISCLAIMER }) }] }
             };
           } else {
-            const access = await checkAccess(clientIp, apiKey);
+            const isOwner = OWNER_KEY !== '' && (req.headers['x-owner-key'] || request.owner_key || '') === OWNER_KEY;
+            if (isOwner) {
+              redisIncr('lms:owner_calls:' + new Date().toISOString().slice(0, 7)).catch(() => {});
+              console.log('[owner] owner key used');
+            }
+            const access = isOwner ? { allowed: true, tier: 'owner', plan: 'owner', remaining: Infinity } : await checkAccess(clientIp, apiKey);
 
             if (!access.allowed) {
               statusCode = 402;