prism-mcp-server 20.0.7 → 20.0.8

package/dist/utils/changelogGenerator.js

@@ -1,158 +0,0 @@
-/**
- * v12.4: AI-Generated Changelogs from Session Ledger History
- *
- * Reads session ledger entries and generates human-readable changelogs
- * in Keep a Changelog format. Uses local LLM (if available) for
- * natural language summarization, with rule-based fallback.
- */
-import { debugLog } from "./logger.js";
-// ─── Changelog Generation ────────────────────────────────────
-/**
- * Classify a ledger summary into a changelog section.
- */
-export function classifySummary(summary) {
-    const lower = summary.toLowerCase();
-    if (/\b(fix|bug|patch|resolve|repair|correct)\b/.test(lower))
-        return "fixed";
-    if (/\b(remov|delet|drop|deprecat|rip out)\b/.test(lower))
-        return "removed";
-    if (/\b(secur|vulnerab|cve|auth|encrypt|permission)\b/.test(lower))
-        return "security";
-    if (/\b(deprecat|sunset|legacy|phase out)\b/.test(lower))
-        return "deprecated";
-    if (/\b(add|creat|new|implement|introduc|support|feat)\b/.test(lower))
-        return "added";
-    return "changed";
-}
-/**
- * Generate a changelog from ledger entries (rule-based).
- */
-export function generateChangelog(entries, options = {}) {
-    const { fromDate, toDate, groupBy = "date", includeFileChanges = false, } = options;
-    // Filter by date range
-    let filtered = entries;
-    if (fromDate) {
-        filtered = filtered.filter(e => new Date(e.created_at) >= new Date(fromDate));
-    }
-    if (toDate) {
-        filtered = filtered.filter(e => new Date(e.created_at) <= new Date(toDate));
-    }
-    // Sort by date (newest first)
-    filtered.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime());
-    const sections = {
-        added: [],
-        changed: [],
-        fixed: [],
-        removed: [],
-        security: [],
-        deprecated: [],
-    };
-    for (const entry of filtered) {
-        const section = classifySummary(entry.summary);
-        let line = entry.summary;
-        if (includeFileChanges && entry.files_changed?.length) {
-            line += ` (${entry.files_changed.join(", ")})`;
-        }
-        sections[section].push(line);
-        // Also classify decisions
-        if (entry.decisions) {
-            for (const decision of entry.decisions) {
-                const dSection = classifySummary(decision);
-                sections[dSection].push(`Decision: ${decision}`);
-            }
-        }
-    }
-    const now = new Date().toISOString().split("T")[0];
-    return {
-        version: "Unreleased",
-        date: now,
-        sections,
-    };
-}
-/**
- * Format a changelog entry as Markdown (Keep a Changelog format).
- */
-export function formatChangelogMarkdown(entry) {
-    const lines = [];
-    lines.push(`## [${entry.version}] - ${entry.date}`);
-    lines.push("");
-    const sectionNames = [
-        ["added", "Added"],
-        ["changed", "Changed"],
-        ["fixed", "Fixed"],
-        ["removed", "Removed"],
-        ["security", "Security"],
-        ["deprecated", "Deprecated"],
-    ];
-    for (const [key, label] of sectionNames) {
-        if (entry.sections[key].length > 0) {
-            lines.push(`### ${label}`);
-            for (const item of entry.sections[key]) {
-                lines.push(`- ${item}`);
-            }
-            lines.push("");
-        }
-    }
-    return lines.join("\n");
-}
-/**
- * Format a changelog entry as HTML.
- */
-export function formatChangelogHtml(entry) {
-    let html = `<h2>[${entry.version}] - ${entry.date}</h2>\n`;
-    const sectionNames = [
-        ["added", "Added"],
-        ["changed", "Changed"],
-        ["fixed", "Fixed"],
-        ["removed", "Removed"],
-        ["security", "Security"],
-        ["deprecated", "Deprecated"],
-    ];
-    for (const [key, label] of sectionNames) {
-        if (entry.sections[key].length > 0) {
-            html += `<h3>${label}</h3>\n<ul>\n`;
-            for (const item of entry.sections[key]) {
-                html += `  <li>${escapeHtml(item)}</li>\n`;
-            }
-            html += `</ul>\n`;
-        }
-    }
-    return html;
-}
-function escapeHtml(str) {
-    return str
-        .replace(/&/g, "&amp;")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;")
-        .replace(/"/g, "&quot;");
-}
-/**
- * Generate a changelog with optional LLM summarization.
- */
-export async function generateChangelogWithLlm(entries, options = {}) {
-    const changelog = generateChangelog(entries, options);
-    const format = options.format || "markdown";
-    if (!options.useLlm) {
-        return format === "html"
-            ? formatChangelogHtml(changelog)
-            : format === "json"
-                ? JSON.stringify(changelog, null, 2)
-                : formatChangelogMarkdown(changelog);
-    }
-    // LLM-enhanced: summarize each section
-    try {
-        const { callLocalLlm } = await import("./localLlm.js");
-        const rawMarkdown = formatChangelogMarkdown(changelog);
-        const enhanced = await callLocalLlm(`You are a technical writer. Rewrite this changelog to be more concise and professional. ` +
-            `Keep the Keep a Changelog format. Combine duplicate entries. ` +
-            `Use action verbs (Added, Fixed, Changed). Output markdown only:\n\n${rawMarkdown}`);
-        return enhanced || rawMarkdown;
-    }
-    catch {
-        debugLog("Changelog: LLM unavailable, using rule-based output");
-        return format === "html"
-            ? formatChangelogHtml(changelog)
-            : formatChangelogMarkdown(changelog);
-    }
-}
-debugLog("v12.4: Changelog generator loaded");

package/dist/utils/fallbackClient.js

@@ -1,52 +0,0 @@
-/**
- * Supabase Direct Fallback Client
- *
- * When prism-mcp Railway/Fly endpoints are unreachable, this module
- * allows critical tools (load_context, save_ledger, save_handoff) to
- * call Supabase REST API directly — bypassing the prism-mcp server.
- *
- * Used by smithery-bridge.mjs health monitor: if /healthz fails 3× in
- * a row, responses include a Retry-After + x-fallback-mode: supabase
- * header so Claude Code can switch to direct-Supabase mode.
- *
- * Architecture:
- *   Normal:   Agent → Railway prism-mcp → Supabase
- *   Fallback: Agent → Supabase REST API directly (read-only for safety)
- */
-const SUPABASE_URL = process.env.SUPABASE_URL || '';
-const SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY || '';
-/**
- * Direct Supabase read — returns last handoff for a project.
- * Called when prism-mcp is unreachable.
- */
-export async function directLoadContext(project) {
-    if (!SUPABASE_URL || !SUPABASE_ANON_KEY)
-        return null;
-    try {
-        const res = await fetch(`${SUPABASE_URL}/rest/v1/session_handoffs?project=eq.${encodeURIComponent(project)}&order=updated_at.desc&limit=1`, { headers: { apikey: SUPABASE_ANON_KEY, Authorization: `Bearer ${SUPABASE_ANON_KEY}` } });
-        if (!res.ok)
-            return null;
-        const [row] = await res.json();
-        if (!row)
-            return null;
-        return {
-            project,
-            lastSummary: row.last_summary ?? '',
-            openTodos: row.open_todos ?? [],
-            keyContext: row.key_context ?? '',
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/** Returns true if Railway prism-mcp primary is reachable. */
-export async function isPrimaryHealthy(primaryUrl) {
-    try {
-        const res = await fetch(`${primaryUrl}/healthz`, { signal: AbortSignal.timeout(3000) });
-        return res.ok;
-    }
-    catch {
-        return false;
-    }
-}

package/dist/utils/memoryAttestation.js

@@ -1,163 +0,0 @@
-/**
- * v12.4: Memory Attestation — SHA-256 Merkle Tree
- *
- * Provides cryptographic proof of memory integrity.
- * Builds a Merkle tree from session entries, enabling:
- *   - Tamper detection on individual entries
- *   - Provable audit trail for compliance
- *   - Efficient partial verification
- */
-import { createHash } from "node:crypto";
-import { debugLog } from "./logger.js";
-// ─── Hashing ─────────────────────────────────────────────────
-/**
- * SHA-256 hash of a string.
- */
-export function sha256(data) {
-    return createHash("sha256").update(data, "utf8").digest("hex");
-}
-/**
- * Hash two child hashes into a parent hash.
- */
-export function hashPair(left, right) {
-    return sha256(left + right);
-}
-/**
- * Hash a memory entry's content for use as a leaf node.
- */
-export function hashEntry(entryId, content, timestamp) {
-    return sha256(`${entryId}:${content}:${timestamp}`);
-}
-// ─── Merkle Tree Construction ────────────────────────────────
-/**
- * Build a Merkle tree from leaf hashes.
- */
-export function buildMerkleTree(entries) {
-    if (entries.length === 0)
-        return null;
-    // Create leaf nodes
-    let nodes = entries.map(e => ({
-        hash: e.hash,
-        entryId: e.id,
-        depth: 0,
-    }));
-    // If odd number of leaves, duplicate the last one
-    if (nodes.length % 2 !== 0) {
-        nodes.push({ ...nodes[nodes.length - 1] });
-    }
-    let depth = 0;
-    // Build tree bottom-up
-    while (nodes.length > 1) {
-        depth++;
-        const next = [];
-        for (let i = 0; i < nodes.length; i += 2) {
-            const left = nodes[i];
-            const right = nodes[i + 1] || left; // Duplicate last if odd
-            next.push({
-                hash: hashPair(left.hash, right.hash),
-                left,
-                right,
-                depth,
-            });
-        }
-        nodes = next;
-    }
-    return nodes[0];
-}
-/**
- * Get the Merkle root hash.
- */
-export function getMerkleRoot(entries) {
-    const tree = buildMerkleTree(entries);
-    return tree?.hash || sha256("empty");
-}
-// ─── Proof Generation & Verification ─────────────────────────
-/**
- * Generate a Merkle proof for a specific entry.
- */
-export function generateProof(entries, targetEntryId) {
-    const targetIdx = entries.findIndex(e => e.id === targetEntryId);
-    if (targetIdx === -1)
-        return null;
-    // Pad to even length
-    const padded = [...entries];
-    if (padded.length % 2 !== 0) {
-        padded.push({ ...padded[padded.length - 1] });
-    }
-    const proof = [];
-    let idx = targetIdx;
-    let currentLevel = padded.map(e => e.hash);
-    while (currentLevel.length > 1) {
-        const nextLevel = [];
-        const siblingIdx = idx % 2 === 0 ? idx + 1 : idx - 1;
-        if (siblingIdx < currentLevel.length) {
-            proof.push({
-                hash: currentLevel[siblingIdx],
-                position: idx % 2 === 0 ? "right" : "left",
-            });
-        }
-        for (let i = 0; i < currentLevel.length; i += 2) {
-            const left = currentLevel[i];
-            const right = currentLevel[i + 1] || left;
-            nextLevel.push(hashPair(left, right));
-        }
-        idx = Math.floor(idx / 2);
-        currentLevel = nextLevel;
-    }
-    const root = currentLevel[0];
-    const entryHash = entries[targetIdx].hash;
-    return {
-        entryId: targetEntryId,
-        entryHash,
-        proof,
-        root,
-        verified: verifyProof(entryHash, proof, root),
-    };
-}
-/**
- * Verify a Merkle proof.
- */
-export function verifyProof(entryHash, proof, expectedRoot) {
-    let currentHash = entryHash;
-    for (const step of proof) {
-        if (step.position === "right") {
-            currentHash = hashPair(currentHash, step.hash);
-        }
-        else {
-            currentHash = hashPair(step.hash, currentHash);
-        }
-    }
-    return currentHash === expectedRoot;
-}
-// ─── Attestation Report ──────────────────────────────────────
-/**
- * Generate a full attestation report for a project's memory.
- */
-export function generateAttestationReport(project, entries) {
-    const hashedEntries = entries.map(e => ({
-        id: e.id,
-        hash: hashEntry(e.id, e.content, e.timestamp),
-    }));
-    const tree = buildMerkleTree(hashedEntries);
-    const report = {
-        root: tree?.hash || sha256("empty"),
-        entryCount: entries.length,
-        treeDepth: tree?.depth || 0,
-        generatedAt: new Date().toISOString(),
-        project,
-        entries: hashedEntries,
-    };
-    debugLog(`Attestation: Generated report for '${project}' — ${entries.length} entries, root: ${report.root.slice(0, 16)}...`);
-    return report;
-}
-/**
- * Verify that a single entry hasn't been tampered with.
- */
-export function verifyEntry(entryId, content, timestamp, report) {
-    const expectedHash = hashEntry(entryId, content, timestamp);
-    const storedEntry = report.entries.find(e => e.id === entryId);
-    if (!storedEntry)
-        return false;
-    return storedEntry.hash === expectedHash;
-}
-debugLog("v12.4: Memory attestation (Merkle tree) loaded");

package/dist/utils/rbac.js

@@ -1,321 +0,0 @@
-/**
- * v12.3: Role-Based Access Control (RBAC) Engine
- *
- * Enforces project-level and partition-level access control.
- * Roles: admin, editor, viewer (extensible via custom roles).
- * Permissions are checked per-project, per-memory-partition.
- *
- * Storage: Local SQLite table `rbac_roles` + `rbac_assignments` (auto-created).
- */
-import { debugLog } from "./logger.js";
-import { homedir } from "node:os";
-import { join } from "node:path";
-// ─── Built-in Role Definitions ───────────────────────────────
-const BUILTIN_ROLES = {
-    admin: {
-        name: "admin",
-        displayName: "Administrator",
-        permissions: { read: true, write: true, delete: true, admin: true },
-        isBuiltin: true,
-        createdAt: "2026-01-01T00:00:00Z",
-    },
-    editor: {
-        name: "editor",
-        displayName: "Editor",
-        permissions: { read: true, write: true, delete: false, admin: false },
-        isBuiltin: true,
-        createdAt: "2026-01-01T00:00:00Z",
-    },
-    viewer: {
-        name: "viewer",
-        displayName: "Viewer",
-        permissions: { read: true, write: false, delete: false, admin: false },
-        isBuiltin: true,
-        createdAt: "2026-01-01T00:00:00Z",
-    },
-};
-// ─── In-Memory State ─────────────────────────────────────────
-const customRoles = new Map();
-const assignments = new Map(); // keyed by `userId:project`
-// ─── Role Management ─────────────────────────────────────────
-export function getRole(name) {
-    return BUILTIN_ROLES[name] || customRoles.get(name);
-}
-export function listRoles() {
-    return [
-        ...Object.values(BUILTIN_ROLES),
-        ...Array.from(customRoles.values()),
-    ];
-}
-export function createCustomRole(name, displayName, permissions) {
-    if (BUILTIN_ROLES[name]) {
-        throw new Error(`Cannot override built-in role: ${name}`);
-    }
-    const role = {
-        name,
-        displayName,
-        permissions,
-        isBuiltin: false,
-        createdAt: new Date().toISOString(),
-    };
-    customRoles.set(name, role);
-    debugLog(`RBAC: Created custom role '${name}' with permissions: ${JSON.stringify(permissions)}`);
-    return role;
-}
-export function deleteCustomRole(name) {
-    if (BUILTIN_ROLES[name]) {
-        throw new Error(`Cannot delete built-in role: ${name}`);
-    }
-    return customRoles.delete(name);
-}
-// ─── Assignment Management ───────────────────────────────────
-function assignmentKey(userId, project) {
-    return `${userId}:${project}`;
-}
-export function assignRole(userId, role, project, assignedBy, partition, expiresAt) {
-    const roleDef = getRole(role);
-    if (!roleDef) {
-        throw new Error(`Unknown role: ${role}. Available: ${listRoles().map(r => r.name).join(", ")}`);
-    }
-    const assignment = {
-        id: `ra_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
-        userId,
-        role,
-        project,
-        partition,
-        assignedBy,
-        assignedAt: new Date().toISOString(),
-        expiresAt,
-    };
-    const key = assignmentKey(userId, project);
-    const existing = assignments.get(key) || [];
-    // Remove existing assignment for same partition (upsert)
-    const filtered = existing.filter(a => a.partition !== partition || a.role !== role);
-    filtered.push(assignment);
-    assignments.set(key, filtered);
-    debugLog(`RBAC: Assigned role '${role}' to user '${userId}' on project '${project}'${partition ? ` partition '${partition}'` : ""}`);
-    return assignment;
-}
-export function revokeRole(userId, role, project, partition) {
-    const key = assignmentKey(userId, project);
-    const existing = assignments.get(key) || [];
-    const filtered = existing.filter(a => !(a.role === role && a.partition === partition));
-    if (filtered.length === existing.length)
-        return false;
-    assignments.set(key, filtered);
-    debugLog(`RBAC: Revoked role '${role}' from user '${userId}' on project '${project}'`);
-    return true;
-}
-export function getUserAssignments(userId, project) {
-    if (project) {
-        return assignments.get(assignmentKey(userId, project)) || [];
-    }
-    // All assignments for this user across projects
-    const all = [];
-    for (const [key, assigns] of assignments) {
-        if (key.startsWith(`${userId}:`)) {
-            all.push(...assigns);
-        }
-    }
-    return all;
-}
-export function getProjectMembers(project) {
-    const members = [];
-    for (const [key, assigns] of assignments) {
-        if (key.endsWith(`:${project}`)) {
-            members.push(...assigns);
-        }
-    }
-    return members;
-}
-// ─── Access Control Checks ───────────────────────────────────
-export function checkAccess(userId, project, permission, partition) {
-    const userAssignments = getUserAssignments(userId, project);
-    if (userAssignments.length === 0) {
-        return {
-            allowed: false,
-            role: "none",
-            permission,
-            project,
-            reason: `User '${userId}' has no role on project '${project}'`,
-        };
-    }
-    // Check for expired assignments
-    const now = new Date();
-    const validAssignments = userAssignments.filter(a => {
-        if (!a.expiresAt)
-            return true;
-        return new Date(a.expiresAt) > now;
-    });
-    if (validAssignments.length === 0) {
-        return {
-            allowed: false,
-            role: "expired",
-            permission,
-            project,
-            reason: `All role assignments for '${userId}' on '${project}' have expired`,
-        };
-    }
-    // If partition is specified, check partition-specific assignments first
-    if (partition) {
-        const partitionAssigns = validAssignments.filter(a => a.partition === partition);
-        if (partitionAssigns.length > 0) {
-            // Use highest-privilege partition assignment
-            for (const assign of partitionAssigns) {
-                const role = getRole(assign.role);
-                if (role && role.permissions[permission]) {
-                    return {
-                        allowed: true,
-                        role: assign.role,
-                        permission,
-                        project,
-                        reason: `Granted via partition-level role '${assign.role}'`,
-                    };
-                }
-            }
-        }
-    }
-    // Check project-level assignments (no partition filter)
-    const projectAssigns = validAssignments.filter(a => !a.partition);
-    for (const assign of projectAssigns) {
-        const role = getRole(assign.role);
-        if (role && role.permissions[permission]) {
-            return {
-                allowed: true,
-                role: assign.role,
-                permission,
-                project,
-                reason: `Granted via project-level role '${assign.role}'`,
-            };
-        }
-    }
-    // No matching permission found
-    const highestRole = validAssignments[0]?.role || "none";
-    return {
-        allowed: false,
-        role: highestRole,
-        permission,
-        project,
-        reason: `Role '${highestRole}' does not have '${permission}' permission on '${project}'`,
-    };
-}
-/**
- * Middleware-style check: throws if access denied.
- */
-export function requireAccess(userId, project, permission, partition) {
-    const result = checkAccess(userId, project, permission, partition);
-    if (!result.allowed) {
-        throw new Error(`Access denied: ${result.reason}`);
-    }
-}
-// ─── SQLite Persistence (lazy-init) ──────────────────────────
-let dbInitialized = false;
-function getRbacDbPath() {
-    return join(process.env.PRISM_DATA_DIR || join(homedir(), ".prism"), "rbac.db");
-}
-export async function persistToDb() {
-    try {
-        // @ts-ignore — dynamic import of optional dependency
-        const Database = (await import("better-sqlite3")).default;
-        const db = new Database(getRbacDbPath());
-        db.exec(`
-            CREATE TABLE IF NOT EXISTS rbac_custom_roles (
-                name TEXT PRIMARY KEY,
-                display_name TEXT NOT NULL,
-                perm_read INTEGER DEFAULT 0,
-                perm_write INTEGER DEFAULT 0,
-                perm_delete INTEGER DEFAULT 0,
-                perm_admin INTEGER DEFAULT 0,
-                created_at TEXT NOT NULL
-            );
-            CREATE TABLE IF NOT EXISTS rbac_assignments (
-                id TEXT PRIMARY KEY,
-                user_id TEXT NOT NULL,
-                role TEXT NOT NULL,
-                project TEXT NOT NULL,
-                partition TEXT,
-                assigned_by TEXT NOT NULL,
-                assigned_at TEXT NOT NULL,
-                expires_at TEXT,
-                UNIQUE(user_id, role, project, partition)
-            );
-        `);
-        // Persist custom roles
-        const upsertRole = db.prepare(`
-            INSERT OR REPLACE INTO rbac_custom_roles
-            (name, display_name, perm_read, perm_write, perm_delete, perm_admin, created_at)
-            VALUES (?, ?, ?, ?, ?, ?, ?)
-        `);
-        for (const role of customRoles.values()) {
-            upsertRole.run(role.name, role.displayName, role.permissions.read ? 1 : 0, role.permissions.write ? 1 : 0, role.permissions.delete ? 1 : 0, role.permissions.admin ? 1 : 0, role.createdAt);
-        }
-        // Persist assignments
-        const upsertAssign = db.prepare(`
-            INSERT OR REPLACE INTO rbac_assignments
-            (id, user_id, role, project, partition, assigned_by, assigned_at, expires_at)
-            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-        `);
-        for (const assigns of assignments.values()) {
-            for (const a of assigns) {
-                upsertAssign.run(a.id, a.userId, a.role, a.project, a.partition || null, a.assignedBy, a.assignedAt, a.expiresAt || null);
-            }
-        }
-        db.close();
-        dbInitialized = true;
-        debugLog("RBAC: Persisted state to SQLite");
-    }
-    catch (err) {
-        debugLog(`RBAC: Persistence failed (non-fatal): ${err}`);
-    }
-}
-export async function loadFromDb() {
-    try {
-        // @ts-ignore
-        const Database = (await import("better-sqlite3")).default;
-        const dbPath = getRbacDbPath();
-        // Check if DB exists before trying to open
-        const { existsSync } = await import("node:fs");
-        if (!existsSync(dbPath))
-            return;
-        const db = new Database(dbPath);
-        // Load custom roles
-        const roles = db.prepare("SELECT * FROM rbac_custom_roles").all();
-        for (const r of roles) {
-            customRoles.set(r.name, {
-                name: r.name,
-                displayName: r.display_name,
-                permissions: {
-                    read: !!r.perm_read,
-                    write: !!r.perm_write,
-                    delete: !!r.perm_delete,
-                    admin: !!r.perm_admin,
-                },
-                isBuiltin: false,
-                createdAt: r.created_at,
-            });
-        }
-        // Load assignments
-        const assigns = db.prepare("SELECT * FROM rbac_assignments").all();
-        for (const a of assigns) {
-            const key = assignmentKey(a.user_id, a.project);
-            const existing = assignments.get(key) || [];
-            existing.push({
-                id: a.id,
-                userId: a.user_id,
-                role: a.role,
-                project: a.project,
-                partition: a.partition || undefined,
-                assignedBy: a.assigned_by,
-                assignedAt: a.assigned_at,
-                expiresAt: a.expires_at || undefined,
-            });
-            assignments.set(key, existing);
-        }
-        db.close();
-        debugLog(`RBAC: Loaded ${roles.length} custom roles, ${assigns.length} assignments from DB`);
-    }
-    catch (err) {
-        debugLog(`RBAC: Load failed (non-fatal, using defaults): ${err}`);
-    }
-}
-debugLog("v12.3: RBAC engine loaded");