prism-mcp-server 20.13.0 → 20.13.1

package/dist/storage/synalux.js

@@ -29,6 +29,8 @@
  *     - getHistory        → POST /api/v1/prism/memory  action=memory_history
  *     - patchLedger       → POST /api/v1/prism/memory  action=save_embedding
  *     - getEntriesMissingEmbeddings → POST /api/v1/prism/memory  action=list_missing_embeddings
+ *     - listProjects      → POST /api/v1/prism/memory  action=list_projects
+ *     - exportLedger      → POST /api/v1/prism/memory  action=export_memory (paginated)
  *
  *   Methods still falling through to SupabaseStorage (Phase 3 Tier B+):
  *   save_experience direct entrypoint, compactLedger, image ops,
@@ -449,6 +451,58 @@ export class SynaluxStorage extends SupabaseStorage {
         const entries = Array.isArray(result.entries) ? result.entries : [];
         return entries;
     }
+    // ─── Project inventory + export ──────────────────────────────
+    // Both portal actions shipped in Phase 3 but the client was never
+    // wired: listProjects and the export path fell through to
+    // SupabaseStorage and threw "Supabase not configured" on every
+    // paid-tier install (2026-08-18 audit).
+    async listProjects() {
+        const result = await this.portalPost("/api/v1/prism/memory", {
+            action: "list_projects",
+        });
+        // Strict on drift: a 200 without a projects ARRAY is a contract change,
+        // not "no projects" — the portal returns projects:[] for genuinely none.
+        // Coercing drift to [] would make callers report empty inventories while
+        // claiming success. (R1 adversarial review 2026-08-18.)
+        if (!Array.isArray(result.projects)) {
+            throw new Error("[SynaluxStorage] list_projects: portal response missing projects[] — contract drift");
+        }
+        return result.projects
+            .map((p) => (typeof p === "string" ? p : p?.project))
+            .filter((name) => typeof name === "string" && name.length > 0);
+    }
+    async exportLedger(project) {
+        // action=export_memory is paginated (EXPORT_PAGE_SIZE=1000). Follow
+        // next_offset until has_more is false, capped at 10 pages to match the
+        // local path's 10k-row OOM guard.
+        //
+        // Strict on drift (R1 adversarial review 2026-08-18): this feeds a
+        // BACKUP. A 200 missing ledger[] or page{} must throw, not degrade —
+        // coercing either would write an empty or silently-truncated export
+        // file that reports ✅ success, which is worse than any error.
+        const rows = [];
+        let offset = 0;
+        for (let page = 0; page < 10; page++) {
+            const result = await this.portalPost("/api/v1/prism/memory", {
+                action: "export_memory",
+                project,
+                offset,
+                limit: 1000,
+            });
+            if (!Array.isArray(result.ledger)) {
+                throw new Error("[SynaluxStorage] export_memory: portal response missing ledger[] — contract drift");
+            }
+            const pageInfo = result.page;
+            if (typeof pageInfo?.has_more !== "boolean") {
+                throw new Error("[SynaluxStorage] export_memory: portal response missing page.has_more — refusing a possibly-truncated export");
+            }
+            rows.push(...result.ledger);
+            if (!pageInfo.has_more || typeof pageInfo.next_offset !== "number")
+                break;
+            offset = pageInfo.next_offset;
+        }
+        return rows;
+    }
     // ─── Time Travel ─────────────────────────────────────────────
     // Phase 3 Tier B: route memory_history through portal instead of
     // falling through to SupabaseStorage (which requires a direct

package/dist/tools/ledgerHandlers.js

@@ -2719,12 +2719,24 @@ export async function sessionExportMemoryHandler(args) {
             debugLog(`[session_export_memory] Exporting project "${project}" as ${format}`);
             // Fetch handoff (live context)
             const ctx = await storage.loadContext(project, "deep", PRISM_USER_ID);
-            // Fetch full ledger (all non-deleted entries, capped at 10k as OOM guard)
-            const ledger = await storage.getLedgerEntries({
-                project: `eq.${project}`,
-                order: "created_at.asc",
-                limit: "10000",
-            });
+            // Fetch full ledger (all non-deleted entries, capped at 10k as OOM guard).
+            // Portal-backed installs export via action=export_memory (exportLedger);
+            // local/direct backends keep the getLedgerEntries assembly. Without this
+            // branch, paid thin-client installs threw "Supabase not configured" here.
+            const ledger = (typeof storage.exportLedger === "function"
+                ? await storage.exportLedger(project)
+                : await storage.getLedgerEntries({
+                    project: `eq.${project}`,
+                    // R1 adversarial review 2026-08-18: without this filter the
+                    // direct/local paths exported TOMBSTONED rows — content the user
+                    // had asked session_forget_memory to erase shipped in every
+                    // backup (GDPR Art. 17 leak; the portal export always excluded
+                    // them, so the two paths also disagreed). Both PostgREST and the
+                    // sqlite filter parser support is.null.
+                    deleted_at: "is.null",
+                    order: "created_at.asc",
+                    limit: "10000",
+                }));
             // Strip raw embedding vectors from the export (large binary / not human-useful)
             // embedding: raw float32 JSON array (~12KB/entry)
             // embedding_compressed: TurboQuant binary blob (~400B/entry, base64 in JSON)

package/dist/tools/prismInferHandler.js

@@ -1090,7 +1090,9 @@ export async function runInfer(args, deps) {
     // describe the request rather than a specific backend.
     const maxTokens = cloudMaxTokens;
     // Cloud fallback only for paid plans
-    const allowCloud = args.cloud_fallback === true && ent.features.cloud_fallback;
+    // let, not const: the reserved-image branch pins this off mid-call so no
+    // later escalation path can carry even the prompt text off-device.
+    let allowCloud = args.cloud_fallback === true && ent.features.cloud_fallback;
     // Verification only for paid plans (free users skip L3 grounding)
     const canVerify = ent.features.grounding_verifier;
     // The portal entitlement is authoritative. A paid plan alone must not
@@ -1106,7 +1108,10 @@ export async function runInfer(args, deps) {
     const verificationGatedArgs = canVerify
         ? args
         : { ...args, verify: false, evidence: undefined };
-    const gatedArgs = canUsePrivateRouteGuard
+    // let, not const: re-pinned below once images are resolved — an image
+    // request must not leave the device through ANY channel, including the
+    // paid ones this gate would otherwise leave enabled.
+    let gatedArgs = canUsePrivateRouteGuard
         ? verificationGatedArgs
         : { ...verificationGatedArgs, route_guard: "local" };
     // §5.2 failure contract: under escalation:"report", safety refusals return
@@ -1190,6 +1195,21 @@ export async function runInfer(args, deps) {
             // fail open: the original images are still in resolvedImages
         }
     }
+    if (resolvedImages?.length) {
+        // Adversarial review R1 (2026-08-18): serving image requests locally is
+        // not enough — two paid side doors still carried content DERIVED from
+        // the pixels off-device. The Synalux route guard POSTs the prompt and
+        // the draft; the Synalux grounding verifier POSTs the draft and the
+        // evidence. A draft written by a model that just read a clinical
+        // screenshot can quote it. Pin both local for EVERY image request, not
+        // just reserved-flagged ones: the content screen is FN-porous by
+        // design, so a clean screen is not a leak clearance. Text-only
+        // requests keep both features.
+        const wouldVerify = gatedArgs.verify ?? ((gatedArgs.evidence?.length ?? 0) > 0);
+        if (wouldVerify)
+            attempts.push({ tier: "verifier", reason: "verifier_skipped_images_stay_local" });
+        gatedArgs = { ...gatedArgs, route_guard: "local", verify: false };
+    }
     if (installed && !layer1RecursionGuard) {
         const l1fn = deps.callLayer1 ?? defaultCallLayer1;
         const l1Model = resolveOllamaName("prism-coder:4b", installed);
@@ -1222,7 +1242,26 @@ export async function runInfer(args, deps) {
         // Null when the deterministic floor did not fire — the verdict then came
         // from the semantic classifier, which has no per-rule attribution.
         const reservedCat = reservedCategory(args.prompt);
-        if (l1 === "OBVIOUS_RESERVED" || l1 === "UNCERTAIN") {
+        if ((l1 === "OBVIOUS_RESERVED" || l1 === "UNCERTAIN")
+            && (resolvedImages?.length ?? 0) > 0) {
+            // Clinical images are PROCESSED, never refused (ruling 2026-08-18:
+            // the standard BCBA role works from scanned assessments and
+            // screenshots — locally, or via the sanctioned prism cloud once it
+            // has an image channel). Local inference is exactly where that
+            // content is SAFE: nothing leaves the device. Refusing here broke
+            // screenshot verification and assessment work for the clinical
+            // enterprise tiers that need it most, while the actual no-leak
+            // property — images never reach unsanctioned cloud — is enforced
+            // architecturally either way. Serve locally with cloud pinned off
+            // for the rest of the call. No text-policy bypass results: an
+            // image-carrying request is STRICTER than the same words without
+            // one (local-only), so attaching an image can only reduce
+            // exposure. The verdict stays in attempts for the audit trail.
+            debugLog(`[prism_infer] Layer 1 verdict=${l1} with images — serving locally, cloud disabled for this call`);
+            attempts.push({ tier: "layer1", reason: `layer1_${l1.toLowerCase()}_image_local_only` });
+            allowCloud = false;
+        }
+        else if (l1 === "OBVIOUS_RESERVED" || l1 === "UNCERTAIN") {
             debugLog(`[prism_infer] Layer 1 verdict=${l1} — reserved content detected`);
             attempts.push({ tier: "layer1", reason: `layer1_${l1.toLowerCase()}` });
             // Images never leave the device, and callCloud has no image channel

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.13.0",
+  "version": "20.13.1",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",