prism-mcp-server 20.0.5 → 20.0.7

package/dist/utils/rbac.js

@@ -0,0 +1,321 @@
+/**
+ * v12.3: Role-Based Access Control (RBAC) Engine
+ *
+ * Enforces project-level and partition-level access control.
+ * Roles: admin, editor, viewer (extensible via custom roles).
+ * Permissions are checked per-project, per-memory-partition.
+ *
+ * Storage: Local SQLite table `rbac_roles` + `rbac_assignments` (auto-created).
+ */
+import { debugLog } from "./logger.js";
+import { homedir } from "node:os";
+import { join } from "node:path";
+// ─── Built-in Role Definitions ───────────────────────────────
+const BUILTIN_ROLES = {
+    admin: {
+        name: "admin",
+        displayName: "Administrator",
+        permissions: { read: true, write: true, delete: true, admin: true },
+        isBuiltin: true,
+        createdAt: "2026-01-01T00:00:00Z",
+    },
+    editor: {
+        name: "editor",
+        displayName: "Editor",
+        permissions: { read: true, write: true, delete: false, admin: false },
+        isBuiltin: true,
+        createdAt: "2026-01-01T00:00:00Z",
+    },
+    viewer: {
+        name: "viewer",
+        displayName: "Viewer",
+        permissions: { read: true, write: false, delete: false, admin: false },
+        isBuiltin: true,
+        createdAt: "2026-01-01T00:00:00Z",
+    },
+};
+// ─── In-Memory State ─────────────────────────────────────────
+const customRoles = new Map();
+const assignments = new Map(); // keyed by `userId:project`
+// ─── Role Management ─────────────────────────────────────────
+export function getRole(name) {
+    return BUILTIN_ROLES[name] || customRoles.get(name);
+}
+export function listRoles() {
+    return [
+        ...Object.values(BUILTIN_ROLES),
+        ...Array.from(customRoles.values()),
+    ];
+}
+export function createCustomRole(name, displayName, permissions) {
+    if (BUILTIN_ROLES[name]) {
+        throw new Error(`Cannot override built-in role: ${name}`);
+    }
+    const role = {
+        name,
+        displayName,
+        permissions,
+        isBuiltin: false,
+        createdAt: new Date().toISOString(),
+    };
+    customRoles.set(name, role);
+    debugLog(`RBAC: Created custom role '${name}' with permissions: ${JSON.stringify(permissions)}`);
+    return role;
+}
+export function deleteCustomRole(name) {
+    if (BUILTIN_ROLES[name]) {
+        throw new Error(`Cannot delete built-in role: ${name}`);
+    }
+    return customRoles.delete(name);
+}
+// ─── Assignment Management ───────────────────────────────────
+function assignmentKey(userId, project) {
+    return `${userId}:${project}`;
+}
+export function assignRole(userId, role, project, assignedBy, partition, expiresAt) {
+    const roleDef = getRole(role);
+    if (!roleDef) {
+        throw new Error(`Unknown role: ${role}. Available: ${listRoles().map(r => r.name).join(", ")}`);
+    }
+    const assignment = {
+        id: `ra_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+        userId,
+        role,
+        project,
+        partition,
+        assignedBy,
+        assignedAt: new Date().toISOString(),
+        expiresAt,
+    };
+    const key = assignmentKey(userId, project);
+    const existing = assignments.get(key) || [];
+    // Remove existing assignment for same partition (upsert)
+    const filtered = existing.filter(a => a.partition !== partition || a.role !== role);
+    filtered.push(assignment);
+    assignments.set(key, filtered);
+    debugLog(`RBAC: Assigned role '${role}' to user '${userId}' on project '${project}'${partition ? ` partition '${partition}'` : ""}`);
+    return assignment;
+}
+export function revokeRole(userId, role, project, partition) {
+    const key = assignmentKey(userId, project);
+    const existing = assignments.get(key) || [];
+    const filtered = existing.filter(a => !(a.role === role && a.partition === partition));
+    if (filtered.length === existing.length)
+        return false;
+    assignments.set(key, filtered);
+    debugLog(`RBAC: Revoked role '${role}' from user '${userId}' on project '${project}'`);
+    return true;
+}
+export function getUserAssignments(userId, project) {
+    if (project) {
+        return assignments.get(assignmentKey(userId, project)) || [];
+    }
+    // All assignments for this user across projects
+    const all = [];
+    for (const [key, assigns] of assignments) {
+        if (key.startsWith(`${userId}:`)) {
+            all.push(...assigns);
+        }
+    }
+    return all;
+}
+export function getProjectMembers(project) {
+    const members = [];
+    for (const [key, assigns] of assignments) {
+        if (key.endsWith(`:${project}`)) {
+            members.push(...assigns);
+        }
+    }
+    return members;
+}
+// ─── Access Control Checks ───────────────────────────────────
+export function checkAccess(userId, project, permission, partition) {
+    const userAssignments = getUserAssignments(userId, project);
+    if (userAssignments.length === 0) {
+        return {
+            allowed: false,
+            role: "none",
+            permission,
+            project,
+            reason: `User '${userId}' has no role on project '${project}'`,
+        };
+    }
+    // Check for expired assignments
+    const now = new Date();
+    const validAssignments = userAssignments.filter(a => {
+        if (!a.expiresAt)
+            return true;
+        return new Date(a.expiresAt) > now;
+    });
+    if (validAssignments.length === 0) {
+        return {
+            allowed: false,
+            role: "expired",
+            permission,
+            project,
+            reason: `All role assignments for '${userId}' on '${project}' have expired`,
+        };
+    }
+    // If partition is specified, check partition-specific assignments first
+    if (partition) {
+        const partitionAssigns = validAssignments.filter(a => a.partition === partition);
+        if (partitionAssigns.length > 0) {
+            // Use highest-privilege partition assignment
+            for (const assign of partitionAssigns) {
+                const role = getRole(assign.role);
+                if (role && role.permissions[permission]) {
+                    return {
+                        allowed: true,
+                        role: assign.role,
+                        permission,
+                        project,
+                        reason: `Granted via partition-level role '${assign.role}'`,
+                    };
+                }
+            }
+        }
+    }
+    // Check project-level assignments (no partition filter)
+    const projectAssigns = validAssignments.filter(a => !a.partition);
+    for (const assign of projectAssigns) {
+        const role = getRole(assign.role);
+        if (role && role.permissions[permission]) {
+            return {
+                allowed: true,
+                role: assign.role,
+                permission,
+                project,
+                reason: `Granted via project-level role '${assign.role}'`,
+            };
+        }
+    }
+    // No matching permission found
+    const highestRole = validAssignments[0]?.role || "none";
+    return {
+        allowed: false,
+        role: highestRole,
+        permission,
+        project,
+        reason: `Role '${highestRole}' does not have '${permission}' permission on '${project}'`,
+    };
+}
+/**
+ * Middleware-style check: throws if access denied.
+ */
+export function requireAccess(userId, project, permission, partition) {
+    const result = checkAccess(userId, project, permission, partition);
+    if (!result.allowed) {
+        throw new Error(`Access denied: ${result.reason}`);
+    }
+}
+// ─── SQLite Persistence (lazy-init) ──────────────────────────
+let dbInitialized = false;
+function getRbacDbPath() {
+    return join(process.env.PRISM_DATA_DIR || join(homedir(), ".prism"), "rbac.db");
+}
+export async function persistToDb() {
+    try {
+        // @ts-ignore — dynamic import of optional dependency
+        const Database = (await import("better-sqlite3")).default;
+        const db = new Database(getRbacDbPath());
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS rbac_custom_roles (
+                name TEXT PRIMARY KEY,
+                display_name TEXT NOT NULL,
+                perm_read INTEGER DEFAULT 0,
+                perm_write INTEGER DEFAULT 0,
+                perm_delete INTEGER DEFAULT 0,
+                perm_admin INTEGER DEFAULT 0,
+                created_at TEXT NOT NULL
+            );
+            CREATE TABLE IF NOT EXISTS rbac_assignments (
+                id TEXT PRIMARY KEY,
+                user_id TEXT NOT NULL,
+                role TEXT NOT NULL,
+                project TEXT NOT NULL,
+                partition TEXT,
+                assigned_by TEXT NOT NULL,
+                assigned_at TEXT NOT NULL,
+                expires_at TEXT,
+                UNIQUE(user_id, role, project, partition)
+            );
+        `);
+        // Persist custom roles
+        const upsertRole = db.prepare(`
+            INSERT OR REPLACE INTO rbac_custom_roles
+            (name, display_name, perm_read, perm_write, perm_delete, perm_admin, created_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?)
+        `);
+        for (const role of customRoles.values()) {
+            upsertRole.run(role.name, role.displayName, role.permissions.read ? 1 : 0, role.permissions.write ? 1 : 0, role.permissions.delete ? 1 : 0, role.permissions.admin ? 1 : 0, role.createdAt);
+        }
+        // Persist assignments
+        const upsertAssign = db.prepare(`
+            INSERT OR REPLACE INTO rbac_assignments
+            (id, user_id, role, project, partition, assigned_by, assigned_at, expires_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        `);
+        for (const assigns of assignments.values()) {
+            for (const a of assigns) {
+                upsertAssign.run(a.id, a.userId, a.role, a.project, a.partition || null, a.assignedBy, a.assignedAt, a.expiresAt || null);
+            }
+        }
+        db.close();
+        dbInitialized = true;
+        debugLog("RBAC: Persisted state to SQLite");
+    }
+    catch (err) {
+        debugLog(`RBAC: Persistence failed (non-fatal): ${err}`);
+    }
+}
+export async function loadFromDb() {
+    try {
+        // @ts-ignore
+        const Database = (await import("better-sqlite3")).default;
+        const dbPath = getRbacDbPath();
+        // Check if DB exists before trying to open
+        const { existsSync } = await import("node:fs");
+        if (!existsSync(dbPath))
+            return;
+        const db = new Database(dbPath);
+        // Load custom roles
+        const roles = db.prepare("SELECT * FROM rbac_custom_roles").all();
+        for (const r of roles) {
+            customRoles.set(r.name, {
+                name: r.name,
+                displayName: r.display_name,
+                permissions: {
+                    read: !!r.perm_read,
+                    write: !!r.perm_write,
+                    delete: !!r.perm_delete,
+                    admin: !!r.perm_admin,
+                },
+                isBuiltin: false,
+                createdAt: r.created_at,
+            });
+        }
+        // Load assignments
+        const assigns = db.prepare("SELECT * FROM rbac_assignments").all();
+        for (const a of assigns) {
+            const key = assignmentKey(a.user_id, a.project);
+            const existing = assignments.get(key) || [];
+            existing.push({
+                id: a.id,
+                userId: a.user_id,
+                role: a.role,
+                project: a.project,
+                partition: a.partition || undefined,
+                assignedBy: a.assigned_by,
+                assignedAt: a.assigned_at,
+                expiresAt: a.expires_at || undefined,
+            });
+            assignments.set(key, existing);
+        }
+        db.close();
+        debugLog(`RBAC: Loaded ${roles.length} custom roles, ${assigns.length} assignments from DB`);
+    }
+    catch (err) {
+        debugLog(`RBAC: Load failed (non-fatal, using defaults): ${err}`);
+    }
+}
+debugLog("v12.3: RBAC engine loaded");

package/dist/utils/skillBudget.js

@@ -0,0 +1,58 @@
+/**
+ * Skill-delivery budgeting — makes the skill block honor the caller's
+ * max_tokens budget instead of inlining every resolved skill.
+ *
+ * Why: paid-tier resolution returns 30+ skills (~114KB measured). Unbudgeted
+ * inlining exceeds host tool-result caps, and hosts divert the WHOLE response
+ * to a file — the agent receives none of it. A budgeted block that fits is
+ * strictly more context than an unbudgeted one that gets diverted.
+ *
+ * Policy (in fill order):
+ *   1. protected skills — ALWAYS inlined in full, even over budget. This is
+ *      the documented floor (2026-06-13 incident: silent truncation stripped
+ *      the agent's core behavioral rules; "protected" exists to prevent that).
+ *   2. prompt-category skills — they matched THIS prompt's keywords; they are
+ *      usually the reason the caller passed `prompt` at all.
+ *   3. everything else (unprotected universal, project, role) by ascending
+ *      priority — while budget remains.
+ * Skills that do not fit are NEVER silently dropped: they are listed in an
+ * overflow manifest so the agent can read them on demand or re-load with a
+ * higher max_tokens.
+ */
+function fillOrder(a, b) {
+    const rank = (e) => e.protected ? 0 : e.category === "prompt" ? 1 : e.category === "role" ? 2 : 3;
+    return rank(a) - rank(b) || a.priority - b.priority;
+}
+function render(e) {
+    const label = e.category === "role" ? "ROLE SKILL" : "SKILL";
+    return `\n\n[📜 ${label}: ${e.name}]\n${e.content.trim()}`;
+}
+/**
+ * Assemble the skill block within `budgetChars`. `budgetChars` ≤ 0 or
+ * non-finite means unbudgeted (legacy behavior: inline everything).
+ */
+export function assembleSkillBlock(entries, budgetChars) {
+    const ordered = [...entries].sort(fillOrder);
+    const unbudgeted = !Number.isFinite(budgetChars) || budgetChars <= 0;
+    let block = "";
+    const inlined = [];
+    const overflow = [];
+    for (const e of ordered) {
+        const piece = render(e);
+        // Protected always inline; others only while they fit.
+        if (unbudgeted || e.protected || block.length + piece.length <= budgetChars) {
+            block += piece;
+            inlined.push(e.name);
+        }
+        else {
+            overflow.push(e.name);
+        }
+    }
+    if (overflow.length > 0) {
+        block +=
+            `\n\n[📦 SKILLS NOT INLINED — max_tokens budget reached]\n` +
+                `${overflow.join(", ")}\n` +
+                `To inline them, re-call session_load_context with a higher max_tokens.`;
+    }
+    return { block, inlined, overflow };
+}

package/dist/utils/tavilyApi.js

@@ -0,0 +1,70 @@
+/**
+ * Tavily API Client
+ *
+ * This module provides Tavily Search and Extract helpers for the Web Scholar
+ * pipeline. It serves as an additive alternative to Brave Search + Firecrawl
+ * when TAVILY_API_KEY is set.
+ *
+ *   1. performTavilySearch — Web search returning URLs (mirrors Brave web search)
+ *   2. performTavilyExtract — URL content extraction returning markdown (mirrors Firecrawl scrape)
+ */
+import { tavily } from "@tavily/core";
+function getClient(apiKey) {
+    return tavily({ apiKey });
+}
+/**
+ * Searches the web via Tavily and returns an array of result objects.
+ */
+export async function performTavilySearch(apiKey, query, maxResults = 10) {
+    try {
+        const client = getClient(apiKey);
+        const response = await client.search(query, {
+            maxResults,
+            searchDepth: "advanced",
+            topic: "general",
+        });
+        return (response.results || []).map((r) => ({
+            title: r.title || "",
+            url: r.url || "",
+            content: r.content || "",
+            score: r.score ?? 0,
+        }));
+    }
+    catch (error) {
+        console.error(`[Tavily Search] Error performing search for query "${query}":`, error);
+        return [];
+    }
+}
+/**
+ * Extracts article content from URLs via Tavily Extract.
+ * Returns markdown content for each successfully extracted URL.
+ */
+export async function performTavilyExtract(apiKey, urls) {
+    if (urls.length === 0)
+        return [];
+    const client = getClient(apiKey);
+    const allResults = [];
+    // Tavily extract accepts up to 20 URLs at once
+    for (let i = 0; i < urls.length; i += 20) {
+        const batch = urls.slice(i, i + 20);
+        try {
+            const response = await client.extract(batch, {
+                extractDepth: "basic",
+            });
+            // Optionally log failed URLs from this batch
+            if (response.failedResults && response.failedResults.length > 0) {
+                console.warn(`[Tavily Extract] Failed to extract ${response.failedResults.length} URLs in this batch.`, response.failedResults);
+            }
+            const mapped = (response.results || []).map((r) => ({
+                url: r.url || "",
+                rawContent: r.rawContent || "",
+            }));
+            allResults.push(...mapped);
+        }
+        catch (error) {
+            // Log the error but continue to the next batch to prevent total data loss
+            console.error(`[Tavily Extract] Error extracting batch ${i} to ${Math.min(i + 20, urls.length)}:`, error);
+        }
+    }
+    return allResults;
+}

package/dist/vm/quotaEnforcer.js

@@ -0,0 +1,192 @@
+/**
+ * v12.5: Tier-Gated VM Quota Enforcer
+ *
+ * Enforces subscription-based VM limits.
+ * Each Synalux tier has maximum VM counts, CPU, RAM, and storage quotas.
+ */
+import { debugLog } from "../utils/logger.js";
+// ─── Tier Quotas ─────────────────────────────────────────────
+const TIER_QUOTAS = {
+    free: {
+        maxVMs: 1,
+        maxCpuCores: 2,
+        maxRamGb: 4,
+        maxStorageGb: 20,
+        maxConcurrentRuns: 1,
+        allowedPlatforms: ["linux"],
+    },
+    standard: {
+        maxVMs: 5,
+        maxCpuCores: 8,
+        maxRamGb: 16,
+        maxStorageGb: 100,
+        maxConcurrentRuns: 2,
+        allowedPlatforms: ["linux", "macos", "windows"],
+    },
+    advanced: {
+        maxVMs: 20,
+        maxCpuCores: 32,
+        maxRamGb: 64,
+        maxStorageGb: 500,
+        maxConcurrentRuns: 5,
+        allowedPlatforms: ["linux", "macos", "windows", "ios", "android", "visionos"],
+    },
+    enterprise: {
+        maxVMs: -1, // unlimited
+        maxCpuCores: -1,
+        maxRamGb: -1,
+        maxStorageGb: -1,
+        maxConcurrentRuns: -1,
+        allowedPlatforms: ["*"],
+    },
+};
+// ─── State ───────────────────────────────────────────────────
+let currentTier = "free";
+let currentUsage = {
+    activeVMs: 0,
+    totalCpuCores: 0,
+    totalRamGb: 0,
+    totalStorageGb: 0,
+    concurrentRuns: 0,
+};
+export function setTier(tier) {
+    currentTier = tier;
+    debugLog(`VM Quota: Tier set to '${tier}'`);
+}
+export function getTier() {
+    return currentTier;
+}
+export function getQuota(tier) {
+    return { ...TIER_QUOTAS[tier || currentTier] };
+}
+export function getUsage() {
+    return { ...currentUsage };
+}
+export function updateUsage(usage) {
+    currentUsage = { ...currentUsage, ...usage };
+}
+// ─── Quota Checks ────────────────────────────────────────────
+function isUnlimited(value) {
+    return value === -1;
+}
+/**
+ * Check if creating a new VM is allowed.
+ */
+export function checkVMCreation(cpuCores = 1, ramGb = 2, storageGb = 10, platform = "linux") {
+    const quota = TIER_QUOTAS[currentTier];
+    // Check platform
+    if (!quota.allowedPlatforms.includes("*") && !quota.allowedPlatforms.includes(platform)) {
+        return {
+            allowed: false,
+            resource: "platform",
+            requested: 0,
+            available: 0,
+            limit: 0,
+            tier: currentTier,
+            reason: `Platform '${platform}' not available on ${currentTier} tier. Available: ${quota.allowedPlatforms.join(", ")}`,
+        };
+    }
+    // Check VM count
+    if (!isUnlimited(quota.maxVMs) && currentUsage.activeVMs >= quota.maxVMs) {
+        return {
+            allowed: false,
+            resource: "vms",
+            requested: 1,
+            available: quota.maxVMs - currentUsage.activeVMs,
+            limit: quota.maxVMs,
+            tier: currentTier,
+            reason: `VM limit reached (${currentUsage.activeVMs}/${quota.maxVMs})`,
+        };
+    }
+    // Check CPU
+    if (!isUnlimited(quota.maxCpuCores) && currentUsage.totalCpuCores + cpuCores > quota.maxCpuCores) {
+        return {
+            allowed: false,
+            resource: "cpu",
+            requested: cpuCores,
+            available: quota.maxCpuCores - currentUsage.totalCpuCores,
+            limit: quota.maxCpuCores,
+            tier: currentTier,
+            reason: `CPU quota exceeded (${currentUsage.totalCpuCores + cpuCores}/${quota.maxCpuCores} cores)`,
+        };
+    }
+    // Check RAM
+    if (!isUnlimited(quota.maxRamGb) && currentUsage.totalRamGb + ramGb > quota.maxRamGb) {
+        return {
+            allowed: false,
+            resource: "ram",
+            requested: ramGb,
+            available: quota.maxRamGb - currentUsage.totalRamGb,
+            limit: quota.maxRamGb,
+            tier: currentTier,
+            reason: `RAM quota exceeded (${currentUsage.totalRamGb + ramGb}/${quota.maxRamGb} GB)`,
+        };
+    }
+    // Check storage
+    if (!isUnlimited(quota.maxStorageGb) && currentUsage.totalStorageGb + storageGb > quota.maxStorageGb) {
+        return {
+            allowed: false,
+            resource: "storage",
+            requested: storageGb,
+            available: quota.maxStorageGb - currentUsage.totalStorageGb,
+            limit: quota.maxStorageGb,
+            tier: currentTier,
+            reason: `Storage quota exceeded (${currentUsage.totalStorageGb + storageGb}/${quota.maxStorageGb} GB)`,
+        };
+    }
+    return {
+        allowed: true,
+        resource: "all",
+        requested: 0,
+        available: 0,
+        limit: 0,
+        tier: currentTier,
+        reason: "All quota checks passed",
+    };
+}
+/**
+ * Check if a concurrent run is allowed.
+ */
+export function checkConcurrentRun() {
+    const quota = TIER_QUOTAS[currentTier];
+    if (!isUnlimited(quota.maxConcurrentRuns) && currentUsage.concurrentRuns >= quota.maxConcurrentRuns) {
+        return {
+            allowed: false,
+            resource: "concurrent_runs",
+            requested: 1,
+            available: quota.maxConcurrentRuns - currentUsage.concurrentRuns,
+            limit: quota.maxConcurrentRuns,
+            tier: currentTier,
+            reason: `Concurrent run limit reached (${currentUsage.concurrentRuns}/${quota.maxConcurrentRuns})`,
+        };
+    }
+    return {
+        allowed: true,
+        resource: "concurrent_runs",
+        requested: 1,
+        available: isUnlimited(quota.maxConcurrentRuns) ? -1 : quota.maxConcurrentRuns - currentUsage.concurrentRuns,
+        limit: quota.maxConcurrentRuns,
+        tier: currentTier,
+        reason: "Concurrent run allowed",
+    };
+}
+/**
+ * Get a summary of quota usage vs limits.
+ */
+export function getQuotaSummary() {
+    const limits = TIER_QUOTAS[currentTier];
+    const pct = (used, max) => max === -1 ? 0 : Math.round((used / max) * 100);
+    return {
+        tier: currentTier,
+        usage: { ...currentUsage },
+        limits: { ...limits },
+        percentUsed: {
+            vms: pct(currentUsage.activeVMs, limits.maxVMs),
+            cpu: pct(currentUsage.totalCpuCores, limits.maxCpuCores),
+            ram: pct(currentUsage.totalRamGb, limits.maxRamGb),
+            storage: pct(currentUsage.totalStorageGb, limits.maxStorageGb),
+            runs: pct(currentUsage.concurrentRuns, limits.maxConcurrentRuns),
+        },
+    };
+}
+debugLog("v12.5: VM quota enforcer loaded");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.0.5",
+  "version": "20.0.7",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local-first storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",