prism-mcp-server 20.0.6 → 20.0.7

package/dist/scm/ciPipeline.js

@@ -0,0 +1,220 @@
+/**
+ * v12.4: GitHub Actions CI/CD Pipeline Generator
+ *
+ * Generates GitHub Actions YAML workflows from Prism project configuration.
+ * Supports test suite integration, automated deployments, and custom triggers.
+ */
+import { debugLog } from "../utils/logger.js";
+// ─── Preset Templates ───────────────────────────────────────
+const PRESETS = {
+    "node-test": {
+        project: "",
+        triggers: [
+            { type: "push", branches: ["main"] },
+            { type: "pull_request", branches: ["main"] },
+        ],
+        jobs: [
+            {
+                name: "test",
+                runsOn: "ubuntu-latest",
+                steps: [
+                    { name: "Checkout", uses: "actions/checkout@v4" },
+                    { name: "Setup Node", uses: "actions/setup-node@v4", with: { "node-version": "20" } },
+                    { name: "Install", run: "npm ci" },
+                    { name: "Lint", run: "npm run lint --if-present" },
+                    { name: "Type Check", run: "npx tsc --noEmit" },
+                    { name: "Test", run: "npm test --if-present" },
+                ],
+            },
+        ],
+    },
+    "npm-publish": {
+        project: "",
+        triggers: [
+            { type: "release", tags: ["v*"] },
+        ],
+        jobs: [
+            {
+                name: "publish",
+                runsOn: "ubuntu-latest",
+                steps: [
+                    { name: "Checkout", uses: "actions/checkout@v4" },
+                    { name: "Setup Node", uses: "actions/setup-node@v4", with: { "node-version": "20", "registry-url": "https://registry.npmjs.org" } },
+                    { name: "Install", run: "npm ci" },
+                    { name: "Build", run: "npm run build" },
+                    { name: "Publish", run: "npm publish", env: { NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}" } },
+                ],
+            },
+        ],
+    },
+    "python-test": {
+        project: "",
+        triggers: [
+            { type: "push", branches: ["main"] },
+            { type: "pull_request", branches: ["main"] },
+        ],
+        jobs: [
+            {
+                name: "test",
+                runsOn: "ubuntu-latest",
+                steps: [
+                    { name: "Checkout", uses: "actions/checkout@v4" },
+                    { name: "Setup Python", uses: "actions/setup-python@v5", with: { "python-version": "3.12" } },
+                    { name: "Install", run: "pip install -e '.[dev]'" },
+                    { name: "Lint", run: "ruff check ." },
+                    { name: "Test", run: "pytest -v" },
+                ],
+            },
+        ],
+    },
+};
+// ─── YAML Generator ──────────────────────────────────────────
+function indent(level) {
+    return "  ".repeat(level);
+}
+function renderTriggers(triggers) {
+    const lines = ["on:"];
+    for (const trigger of triggers) {
+        switch (trigger.type) {
+            case "push":
+                lines.push(`${indent(1)}push:`);
+                if (trigger.branches?.length) {
+                    lines.push(`${indent(2)}branches: [${trigger.branches.map(b => `"${b}"`).join(", ")}]`);
+                }
+                if (trigger.paths?.length) {
+                    lines.push(`${indent(2)}paths:`);
+                    for (const p of trigger.paths)
+                        lines.push(`${indent(3)}- "${p}"`);
+                }
+                break;
+            case "pull_request":
+                lines.push(`${indent(1)}pull_request:`);
+                if (trigger.branches?.length) {
+                    lines.push(`${indent(2)}branches: [${trigger.branches.map(b => `"${b}"`).join(", ")}]`);
+                }
+                break;
+            case "schedule":
+                lines.push(`${indent(1)}schedule:`);
+                lines.push(`${indent(2)}- cron: "${trigger.cron || "0 0 * * *"}"`);
+                break;
+            case "workflow_dispatch":
+                lines.push(`${indent(1)}workflow_dispatch:`);
+                break;
+            case "release":
+                lines.push(`${indent(1)}release:`);
+                lines.push(`${indent(2)}types: [published]`);
+                break;
+        }
+    }
+    return lines.join("\n");
+}
+function renderStep(step, level) {
+    const lines = [];
+    lines.push(`${indent(level)}- name: "${step.name}"`);
+    if (step.condition) {
+        lines.push(`${indent(level + 1)}if: ${step.condition}`);
+    }
+    if (step.uses) {
+        lines.push(`${indent(level + 1)}uses: ${step.uses}`);
+    }
+    if (step.run) {
+        if (step.run.includes("\n")) {
+            lines.push(`${indent(level + 1)}run: |`);
+            for (const line of step.run.split("\n")) {
+                lines.push(`${indent(level + 2)}${line}`);
+            }
+        }
+        else {
+            lines.push(`${indent(level + 1)}run: ${step.run}`);
+        }
+    }
+    if (step.with && Object.keys(step.with).length > 0) {
+        lines.push(`${indent(level + 1)}with:`);
+        for (const [k, v] of Object.entries(step.with)) {
+            lines.push(`${indent(level + 2)}${k}: "${v}"`);
+        }
+    }
+    if (step.env && Object.keys(step.env).length > 0) {
+        lines.push(`${indent(level + 1)}env:`);
+        for (const [k, v] of Object.entries(step.env)) {
+            lines.push(`${indent(level + 2)}${k}: ${v}`);
+        }
+    }
+    return lines.join("\n");
+}
+/**
+ * Generate a GitHub Actions YAML workflow from a pipeline config.
+ */
+export function generateWorkflow(config) {
+    const lines = [];
+    lines.push(`name: ${config.project || "CI"}`);
+    lines.push("");
+    lines.push(renderTriggers(config.triggers));
+    lines.push("");
+    if (config.env && Object.keys(config.env).length > 0) {
+        lines.push("env:");
+        for (const [k, v] of Object.entries(config.env)) {
+            lines.push(`${indent(1)}${k}: "${v}"`);
+        }
+        lines.push("");
+    }
+    if (config.concurrency) {
+        lines.push("concurrency:");
+        lines.push(`${indent(1)}group: ${config.concurrency.group}`);
+        lines.push(`${indent(1)}cancel-in-progress: ${config.concurrency.cancelInProgress}`);
+        lines.push("");
+    }
+    lines.push("jobs:");
+    for (const job of config.jobs) {
+        lines.push(`${indent(1)}${job.name.replace(/\s+/g, "-").toLowerCase()}:`);
+        lines.push(`${indent(2)}runs-on: ${job.runsOn}`);
+        if (job.timeout) {
+            lines.push(`${indent(2)}timeout-minutes: ${job.timeout}`);
+        }
+        if (job.needs?.length) {
+            lines.push(`${indent(2)}needs: [${job.needs.join(", ")}]`);
+        }
+        if (job.condition) {
+            lines.push(`${indent(2)}if: ${job.condition}`);
+        }
+        if (job.env && Object.keys(job.env).length > 0) {
+            lines.push(`${indent(2)}env:`);
+            for (const [k, v] of Object.entries(job.env)) {
+                lines.push(`${indent(3)}${k}: "${v}"`);
+            }
+        }
+        lines.push(`${indent(2)}steps:`);
+        for (const step of job.steps) {
+            lines.push(renderStep(step, 3));
+        }
+        lines.push("");
+    }
+    const yaml = lines.join("\n");
+    return {
+        filename: `.github/workflows/${config.project || "ci"}.yml`,
+        yaml,
+        description: `CI/CD workflow for ${config.project || "project"}`,
+    };
+}
+/**
+ * Generate a workflow from a preset template.
+ */
+export function generateFromPreset(preset, project) {
+    const config = PRESETS[preset];
+    if (!config) {
+        debugLog(`CI Pipeline: Unknown preset '${preset}'. Available: ${Object.keys(PRESETS).join(", ")}`);
+        return null;
+    }
+    return generateWorkflow({ ...config, project });
+}
+/**
+ * List available preset templates.
+ */
+export function listPresets() {
+    return [
+        { name: "node-test", description: "Node.js CI: lint, type-check, test" },
+        { name: "npm-publish", description: "npm publish on release tag" },
+        { name: "python-test", description: "Python CI: ruff lint, pytest" },
+    ];
+}
+debugLog("v12.4: CI pipeline generator loaded");

package/dist/server.js

@@ -985,7 +985,7 @@ export function createServer() {
                         result = await knowledgeIngestHandler(args);
                         break;
                     case "inference_metrics":
-                        result = await inferenceMetricsHandler();
+                        result = await inferenceMetricsHandler(args);
                         break;
                     default:
                         result = {

package/dist/storage/inferMetricsLedger.js

@@ -0,0 +1,159 @@
+/**
+ * Persistent inference-metrics ledger — append-only rows in the same
+ * ~/.prism-mcp/prism-config.db used by configStorage.
+ *
+ * Purpose: the in-memory counters in utils/inferenceMetrics.ts reset with
+ * every MCP server process, which made "how much do we actually delegate?"
+ * unanswerable. This ledger is the durable record that delegation goal
+ * metrics (local vs cloud volume over time) are computed from.
+ *
+ * Contract:
+ *   - appendInferMetric() is fire-and-forget: it must NEVER throw or delay
+ *     the inference hot path. Failures are debug-logged and dropped.
+ *   - safety_gate calls are excluded by the caller (recordInference returns
+ *     before reaching us) — crisis-filter triggers are never persisted.
+ *   - gate_outcome / refusal_reason / caller are nullable now and filled by
+ *     the Phase-1 failure contract without a schema migration.
+ */
+import { createClient } from "@libsql/client";
+import { resolve, dirname } from "path";
+import { homedir } from "os";
+import { existsSync, mkdirSync } from "fs";
+import { debugLog } from "../utils/logger.js";
+// Resolution order:
+//   1. PRISM_INFER_LEDGER_DB_PATH — explicit override (tests, relocation)
+//   2. PRISM_DATA_DIR — the test-suite sandbox (tests/setup.ts) and any
+//      operator-relocated data root; REQUIRED so `npm test` never writes
+//      fabricated rows into the real user ledger
+//   3. default ~/.prism-mcp/prism-config.db (shared with configStorage)
+function dbPath() {
+    if (process.env.PRISM_INFER_LEDGER_DB_PATH)
+        return process.env.PRISM_INFER_LEDGER_DB_PATH;
+    if (process.env.PRISM_DATA_DIR)
+        return resolve(process.env.PRISM_DATA_DIR, "prism-config.db");
+    return resolve(homedir(), ".prism-mcp", "prism-config.db");
+}
+let client = null;
+let ensured = null;
+let disabled = false;
+let initFailures = 0;
+const MAX_INIT_FAILURES = 3;
+function ensureTable() {
+    if (!ensured) {
+        ensured = (async () => {
+            const path = dbPath();
+            const dir = dirname(path);
+            if (!existsSync(dir))
+                mkdirSync(dir, { recursive: true });
+            client = createClient({ url: `file:${path}` });
+            // Shared file with configStorage — wait out short write locks
+            // instead of failing (transient SQLITE_BUSY must not kill the
+            // ledger). Best-effort: an unsupported PRAGMA must not disable us.
+            await client.execute(`PRAGMA busy_timeout = 2000`).catch(() => { });
+            await client.execute(`
+                CREATE TABLE IF NOT EXISTS infer_metrics (
+                    id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    ts INTEGER NOT NULL,
+                    caller TEXT,
+                    mode TEXT,
+                    backend TEXT NOT NULL,
+                    model TEXT,
+                    used_cloud INTEGER NOT NULL,
+                    gate_outcome TEXT,
+                    refusal_reason TEXT,
+                    prompt_tokens INTEGER,
+                    completion_tokens INTEGER,
+                    latency_ms INTEGER,
+                    ram_free_mb INTEGER
+                )`);
+            await client.execute(`CREATE INDEX IF NOT EXISTS idx_infer_metrics_ts ON infer_metrics (ts)`);
+        })().catch((e) => {
+            // Transient failures (missing dir on first run, SQLITE_BUSY) retry on
+            // the next append; only repeated failure disables for the process.
+            initFailures++;
+            ensured = null;
+            client = null;
+            if (initFailures >= MAX_INIT_FAILURES)
+                disabled = true;
+            debugLog(`[infer-ledger] init failed (${initFailures}/${MAX_INIT_FAILURES}${disabled ? ", ledger disabled" : ", will retry"}): ${e instanceof Error ? e.message : e}`);
+        });
+    }
+    return ensured;
+}
+/** Append one row. Fire-and-forget — never throws, never blocks the caller. */
+export function appendInferMetric(row) {
+    if (disabled)
+        return;
+    void (async () => {
+        await ensureTable();
+        if (disabled || !client)
+            return;
+        await client.execute({
+            sql: `INSERT INTO infer_metrics
+                  (ts, caller, mode, backend, model, used_cloud, gate_outcome,
+                   refusal_reason, prompt_tokens, completion_tokens, latency_ms, ram_free_mb)
+                  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+            args: [
+                Date.now(), row.caller ?? "mcp", row.mode ?? null, row.backend,
+                row.model, row.used_cloud ? 1 : 0, row.gate_outcome ?? null,
+                row.refusal_reason ?? null, row.prompt_tokens ?? null,
+                row.completion_tokens ?? null, row.latency_ms ?? null,
+                row.ram_free_mb ?? null,
+            ],
+        });
+    })().catch((e) => {
+        debugLog(`[infer-ledger] append failed: ${e instanceof Error ? e.message : e}`);
+    });
+}
+/** Aggregate all persisted rows (optionally since a timestamp). */
+export async function queryInferMetrics(sinceTs) {
+    try {
+        await ensureTable();
+        if (disabled || !client)
+            return null;
+        const where = sinceTs != null ? `WHERE ts >= ?` : "";
+        const whereArgs = sinceTs != null ? [Math.floor(sinceTs)] : [];
+        const agg = await client.execute({
+            sql: `
+            SELECT COUNT(*) AS total,
+                   SUM(CASE WHEN used_cloud = 0 THEN 1 ELSE 0 END) AS local,
+                   SUM(CASE WHEN used_cloud = 1 THEN 1 ELSE 0 END) AS cloud,
+                   COALESCE(SUM(prompt_tokens), 0) AS pt,
+                   COALESCE(SUM(completion_tokens), 0) AS ct,
+                   COALESCE(AVG(latency_ms), 0) AS avg_lat,
+                   MIN(ts) AS first_ts, MAX(ts) AS last_ts
+            FROM infer_metrics ${where}`, args: whereArgs
+        });
+        const byB = await client.execute({
+            sql: `SELECT backend, COUNT(*) AS n FROM infer_metrics ${where} GROUP BY backend`,
+            args: whereArgs
+        });
+        const r = agg.rows[0];
+        const by_backend = {};
+        for (const row of byB.rows) {
+            by_backend[String(row.backend)] = Number(row.n);
+        }
+        return {
+            total: Number(r.total ?? 0),
+            local: Number(r.local ?? 0),
+            cloud: Number(r.cloud ?? 0),
+            prompt_tokens: Number(r.pt ?? 0),
+            completion_tokens: Number(r.ct ?? 0),
+            avg_latency_ms: Math.round(Number(r.avg_lat ?? 0)),
+            first_ts: r.first_ts == null ? null : Number(r.first_ts),
+            last_ts: r.last_ts == null ? null : Number(r.last_ts),
+            by_backend,
+        };
+    }
+    catch (e) {
+        debugLog(`[infer-ledger] query failed: ${e instanceof Error ? e.message : e}`);
+        return null;
+    }
+}
+/** Test hook — reset module state so a fresh DB path/env can be exercised. */
+export function _resetInferLedgerForTest() {
+    client = null;
+    ensured = null;
+    disabled = false;
+    initFailures = 0;
+}

package/dist/sync/encryptedSync.js

@@ -0,0 +1,172 @@
+/**
+ * v12.3: Encrypted Peer-to-Peer Session Syncing
+ *
+ * AES-256-GCM encryption for session data transmission between
+ * Prism instances. Supports both stdio pipe and WebSocket transports.
+ *
+ * Architecture:
+ *   1. Generate per-sync ephemeral key (ECDH key exchange)
+ *   2. Encrypt session payloads with AES-256-GCM
+ *   3. Transfer via stdio pipe (local) or WebSocket (remote)
+ *   4. Verify integrity with HMAC-SHA256
+ */
+import { debugLog } from "../utils/logger.js";
+import crypto from "node:crypto";
+const { createHash, randomBytes, createCipheriv, createDecipheriv } = crypto;
+// ─── Encryption / Decryption ─────────────────────────────────
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
+const KEY_LENGTH = 32;
+/**
+ * Derive a symmetric key from a shared secret using SHA-256.
+ */
+export function deriveKey(sharedSecret) {
+    return createHash("sha256").update(sharedSecret).digest();
+}
+/**
+ * Generate a random encryption key.
+ */
+export function generateKey() {
+    return randomBytes(KEY_LENGTH);
+}
+/**
+ * Encrypt a payload with AES-256-GCM.
+ */
+export function encrypt(plaintext, key) {
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(plaintext, "utf8", "hex");
+    encrypted += cipher.final("hex");
+    return {
+        iv: iv.toString("hex"),
+        data: encrypted,
+        tag: cipher.getAuthTag().toString("hex"),
+        algorithm: ALGORITHM,
+    };
+}
+/**
+ * Decrypt an AES-256-GCM encrypted packet.
+ */
+export function decrypt(packet, key) {
+    const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(packet.iv, "hex"));
+    decipher.setAuthTag(Buffer.from(packet.tag, "hex"));
+    let decrypted = decipher.update(packet.data, "hex", "utf8");
+    decrypted += decipher.final("utf8");
+    return decrypted;
+}
+// ─── Sync Payload Construction ───────────────────────────────
+/**
+ * Create a checksum for a sync payload (integrity verification).
+ */
+export function computeChecksum(entries) {
+    const hash = createHash("sha256");
+    for (const entry of entries) {
+        hash.update(entry.id);
+        hash.update(entry.data);
+    }
+    return hash.digest("hex");
+}
+/**
+ * Build a sync payload from session entries.
+ */
+export function buildSyncPayload(sourceId, targetId, entries) {
+    return {
+        version: 1,
+        sourceId,
+        targetId,
+        timestamp: new Date().toISOString(),
+        entries,
+        checksum: computeChecksum(entries),
+    };
+}
+/**
+ * Verify a received sync payload's integrity.
+ */
+export function verifySyncPayload(payload) {
+    const computed = computeChecksum(payload.entries);
+    if (computed.length !== payload.checksum.length)
+        return false;
+    return crypto.timingSafeEqual(Buffer.from(computed), Buffer.from(payload.checksum));
+}
+// ─── Peer Management ─────────────────────────────────────────
+const peers = new Map();
+export function registerPeer(peer) {
+    peers.set(peer.id, peer);
+    debugLog(`Sync: Registered peer '${peer.name}' (${peer.transport})`);
+}
+export function removePeer(peerId) {
+    return peers.delete(peerId);
+}
+export function listPeers() {
+    return Array.from(peers.values());
+}
+export function getPeer(peerId) {
+    return peers.get(peerId);
+}
+// ─── Sync Execution ──────────────────────────────────────────
+/**
+ * Execute an encrypted sync with a peer.
+ * In this implementation, we prepare the encrypted payload — the actual
+ * transport (stdio/WebSocket) is pluggable.
+ */
+export async function prepareSyncPacket(sourceId, targetPeerId, entries, sharedSecret) {
+    const payload = buildSyncPayload(sourceId, targetPeerId, entries);
+    const key = deriveKey(sharedSecret);
+    const encrypted = encrypt(JSON.stringify(payload), key);
+    debugLog(`Sync: Prepared encrypted packet with ${entries.length} entries for peer '${targetPeerId}'`);
+    return {
+        encrypted,
+        metadata: {
+            entryCount: entries.length,
+            checksum: payload.checksum,
+        },
+    };
+}
+/**
+ * Receive and decrypt a sync packet.
+ */
+export function receiveSyncPacket(encrypted, sharedSecret) {
+    const key = deriveKey(sharedSecret);
+    const decrypted = decrypt(encrypted, key);
+    // Wrap JSON.parse so a malformed payload from a misbehaving peer doesn't
+    // crash the receiver with an unhandled SyntaxError. We re-throw with a
+    // typed message so callers can distinguish corruption from auth failures.
+    let payload;
+    try {
+        payload = JSON.parse(decrypted);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new Error(`Sync payload corrupted: invalid JSON (${msg})`);
+    }
+    if (!verifySyncPayload(payload)) {
+        throw new Error("Sync payload integrity check failed — checksum mismatch");
+    }
+    debugLog(`Sync: Received and verified packet with ${payload.entries.length} entries from '${payload.sourceId}'`);
+    return payload;
+}
+/**
+ * Resolve conflicts between local and remote entries (last-writer-wins).
+ */
+export function resolveConflicts(local, remote) {
+    const localMap = new Map(local.map(e => [e.id, e]));
+    let conflictsResolved = 0;
+    for (const remoteEntry of remote) {
+        const localEntry = localMap.get(remoteEntry.id);
+        if (localEntry) {
+            // Last-writer-wins
+            if (new Date(remoteEntry.createdAt) > new Date(localEntry.createdAt)) {
+                localMap.set(remoteEntry.id, remoteEntry);
+                conflictsResolved++;
+            }
+        }
+        else {
+            localMap.set(remoteEntry.id, remoteEntry);
+        }
+    }
+    return {
+        merged: Array.from(localMap.values()),
+        conflictsResolved,
+    };
+}
+debugLog("v12.3: Encrypted sync module loaded");