prism-mcp-server 20.2.0 → 20.2.1

package/README.md

@@ -18,6 +18,18 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 
 ---
 
+## What's New in v20.2.1
+
+### Subscription-Aware Memory Storage
+`prism connect` now carries an explicit `PRISM_STORAGE=auto|local|synalux|supabase`
+into every managed host registration and rejects invalid values before changing a
+config file. In `auto`, a portal-confirmed free tier uses local SQLite, while
+Standard, Advanced, and Enterprise use Synalux cloud memory. If entitlement
+resolution is unavailable, Prism fails closed instead of splitting history across
+backends. Storage remains independent of local-first model routing.
+
+---
+
 ## What's New in v20.2.0
 
 ### One Command Connects Every Supported Host
@@ -124,6 +136,11 @@ an entry previously created by Prism; custom entries remain untouched.
 Close the target MCP hosts before a non-dry-run registration so they cannot
 edit their configuration at the same time.
 
+Set `PRISM_STORAGE` before running `prism connect` to preserve an explicit
+storage choice in the generated host entries. This does not change local-model
+routing; Synalux cloud storage separately requires an active cloud-memory
+entitlement.
+
 Codex registration preserves `~/.codex/config.toml` and appends only a marked
 Prism-managed block. `CODEX_HOME` is respected when set and must already exist,
 matching Codex's own contract. Restart Codex CLI, the
@@ -692,7 +709,7 @@ Routing is automatic: `9b → 4b → cloud fallback` on desktop/server, `2b →
 | `PRISM_FORCE_LOCAL` | Force local SQLite regardless of credentials | `false` |
 | `TELEMETRY_WRITE_TOKEN` | Portal analytics token (optional — metrics display works without it) | -- |
 
-With no variables set, Prism runs fully local. Set `PRISM_SYNALUX_API_KEY` (and leave `PRISM_STORAGE=auto`) to use the cloud backend.
+With no variables set, Prism runs fully local. With an active cloud-memory subscription, set `PRISM_SYNALUX_API_KEY` (and leave `PRISM_STORAGE=auto`) to use the Synalux backend; a portal-confirmed free tier remains on local SQLite.
 
 ---
 

package/dist/cli.js

@@ -67,7 +67,7 @@ program
             console.log('\nDry run complete — no files changed.');
         }
         if (!summary.usedApiKey) {
-            console.log('PRISM_SYNALUX_API_KEY is not set; new registrations use local/free mode.');
+            console.log('PRISM_SYNALUX_API_KEY is not set; no Synalux subscription key was copied into new registrations.');
         }
     }
     catch (err) {

package/dist/config.js

@@ -81,7 +81,8 @@ export const GOOGLE_SEARCH_CX = process.env.GOOGLE_SEARCH_CX;
 //
 // Auto-resolution (PRISM_STORAGE=auto, the default) picks in this order:
 //   1. PRISM_FORCE_LOCAL=true → "local" (override everything)
-//   2. SYNALUX_API_KEY + PRISM_SYNALUX_BASE_URL set → "synalux"
+//   2. Synalux credentials + portal-confirmed cloud-memory entitlement → "synalux"
+//      (portal-confirmed free → "local"; unverifiable entitlement → fail closed)
 //   3. SUPABASE_URL + SUPABASE_KEY set → "supabase" (legacy)
 //   4. else → "local"
 export const PRISM_STORAGE = process.env.PRISM_STORAGE || "auto";

package/dist/connect.js

@@ -25,6 +25,7 @@ const HOST_ALIASES = {
 };
 const CODEX_MANAGED_START = "# >>> prism connect managed: prism-mcp";
 const CODEX_MANAGED_END = "# <<< prism connect managed: prism-mcp";
+const CONNECT_STORAGE_BACKENDS = ["auto", "local", "synalux", "supabase"];
 export function normalizeHostName(value) {
     const normalized = value.trim().toLowerCase();
     const host = HOST_ALIASES[normalized];
@@ -208,10 +209,14 @@ function executableExists(name, platform, pathEnv) {
     return false;
 }
 function buildMcpEntry(nodePath, serverPath, env) {
+    const storage = env.PRISM_STORAGE ?? "auto";
+    if (!CONNECT_STORAGE_BACKENDS.includes(storage)) {
+        throw new Error(`Invalid PRISM_STORAGE "${storage}". Choose one of: ${CONNECT_STORAGE_BACKENDS.join(", ")}`);
+    }
     const serverEnv = {
         PRISM_INSTANCE: "prism-mcp",
         PRISM_SYNALUX_BASE_URL: env.PRISM_SYNALUX_BASE_URL || "https://synalux.ai",
-        PRISM_STORAGE: "auto",
+        PRISM_STORAGE: storage,
     };
     if (env.PRISM_SYNALUX_API_KEY) {
         serverEnv.PRISM_SYNALUX_API_KEY = env.PRISM_SYNALUX_API_KEY;

package/dist/storage/index.js

@@ -68,9 +68,19 @@ export async function getStorage() {
         debugLog("[Prism Storage] PRISM_FORCE_LOCAL=true — forcing local SQLite");
     }
     // ─── Resolve "auto" → synalux > supabase > local ─────────────
+    // Synalux is eligible only when the portal is the entitlement source;
+    // direct Supabase remains an independent legacy backend.
     if (requested === "auto") {
         if (await ensureSynaluxCredentials()) {
-            requested = "synalux";
+            const { getEntitlements } = await import("../utils/entitlements.js");
+            const entitlements = await getEntitlements();
+            const memoryEntitled = entitlements.features?.session_memory_unlimited;
+            if (entitlements.source !== "portal" || typeof memoryEntitled !== "boolean") {
+                throw new Error("[Prism Storage] Could not verify the Synalux cloud-memory entitlement. " +
+                    "Refusing to fall back to another backend because that could split session history. " +
+                    "Retry when Synalux is reachable or set PRISM_STORAGE=local explicitly.");
+            }
+            requested = memoryEntitled ? "synalux" : "local";
         }
         else if (await ensureSupabaseCredentials()) {
             requested = "supabase";

package/dist/storage/inferMetricsLedger.js

@@ -38,6 +38,18 @@ let ensured = null;
 let disabled = false;
 let initFailures = 0;
 const MAX_INIT_FAILURES = 3;
+function closeClient(context) {
+    const activeClient = client;
+    client = null;
+    if (!activeClient)
+        return;
+    try {
+        activeClient.close();
+    }
+    catch (e) {
+        debugLog(`[infer-ledger] ${context} close failed: ${e instanceof Error ? e.message : e}`);
+    }
+}
 function ensureTable() {
     if (!ensured) {
         ensured = (async () => {
@@ -72,7 +84,7 @@ function ensureTable() {
             // the next append; only repeated failure disables for the process.
             initFailures++;
             ensured = null;
-            client = null;
+            closeClient("init failure");
             if (initFailures >= MAX_INIT_FAILURES)
                 disabled = true;
             debugLog(`[infer-ledger] init failed (${initFailures}/${MAX_INIT_FAILURES}${disabled ? ", ledger disabled" : ", will retry"}): ${e instanceof Error ? e.message : e}`);
@@ -152,7 +164,10 @@ export async function queryInferMetrics(sinceTs) {
 }
 /** Test hook — reset module state so a fresh DB path/env can be exercised. */
 export function _resetInferLedgerForTest() {
-    client = null;
+    // Close the logical client instead of only dropping its reference.
+    // libsql 0.5.29 can still retain native prepared-statement handles until
+    // V8 GC (libsql-js#228), so this is not a synchronous file-unlock barrier.
+    closeClient("test reset");
     ensured = null;
     disabled = false;
     initFailures = 0;

package/dist/storage/sqlite.js

@@ -1,7 +1,7 @@
 /**
  * SQLite Local Storage Backend (v2.0 — Step 2)
  *
- * Zero-cloud, local-first storage using @libsql/client (libSQL/SQLite).
+ * Zero-cloud local SQLite storage using @libsql/client (libSQL/SQLite).
  * Data lives at ~/.prism-mcp/data.db — no account, no API keys, no network.
  *
  * ═══════════════════════════════════════════════════════════════════

package/dist/utils/entitlements.js

@@ -68,7 +68,11 @@ export function clampCeiling(requested, planCeiling) {
 }
 // ── Fetch ─────────────────────────────────────────────────────────
 async function fetchEntitlements() {
-    if (!SYNALUX_CONFIGURED || !PRISM_SYNALUX_BASE_URL) {
+    // Re-read process.env because dashboard/bootstrap configuration can inject
+    // credentials after config.ts captured its module-load constants.
+    const baseUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() || PRISM_SYNALUX_BASE_URL;
+    const apiKey = process.env.PRISM_SYNALUX_API_KEY?.trim();
+    if ((!SYNALUX_CONFIGURED && !apiKey) || !baseUrl) {
         debugLog("[entitlements] no Synalux auth configured — free tier");
         return { ...FREE_ENTITLEMENTS, source: "unconfigured" };
     }
@@ -78,7 +82,7 @@ async function fetchEntitlements() {
         return { ...FREE_ENTITLEMENTS, source: "fallback_free" };
     }
     try {
-        const url = `${PRISM_SYNALUX_BASE_URL}/api/v1/prism/entitlements`;
+        const url = `${baseUrl}/api/v1/prism/entitlements`;
         const res = await fetch(url, {
             method: "GET",
             headers: { Authorization: `Bearer ${jwt}` },

package/dist/utils/synaluxJwt.js

@@ -32,7 +32,11 @@ let inFlight = null;
  * Concurrent callers share a single in-flight exchange (no thundering herd).
  */
 export async function getSynaluxJwt() {
-    if (!PRISM_SYNALUX_BASE_URL || !PRISM_SYNALUX_API_KEY) {
+    // Re-read process.env because storage/dashboard configuration can inject
+    // credentials after config.ts captured its module-load constants.
+    const baseUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() || PRISM_SYNALUX_BASE_URL;
+    const apiKey = process.env.PRISM_SYNALUX_API_KEY?.trim() || PRISM_SYNALUX_API_KEY;
+    if (!baseUrl || !apiKey) {
         return null;
     }
     const now = Date.now();
@@ -43,11 +47,11 @@ export async function getSynaluxJwt() {
         return inFlight;
     inFlight = (async () => {
         try {
-            const url = `${PRISM_SYNALUX_BASE_URL}/api/v1/auth/jwt`;
+            const url = `${baseUrl}/api/v1/auth/jwt`;
             const res = await fetch(url, {
                 method: "POST",
                 headers: {
-                    "Authorization": `Bearer ${PRISM_SYNALUX_API_KEY}`,
+                    "Authorization": `Bearer ${apiKey}`,
                     "Content-Type": "application/json",
                 },
                 signal: AbortSignal.timeout(10_000),

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.2.0",
+  "version": "20.2.1",
   "mcpName": "io.github.dcostenco/prism-coder",
-  "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local-first storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
+  "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local or subscription-gated Synalux storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",
   "type": "module",
   "main": "dist/server.js",
@@ -16,6 +16,8 @@
     "dist"
   ],
   "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "prebuild": "npm run clean",
     "build": "tsc && npm run chmod-bins",
     "chmod-bins": "node -e \"['dist/cli.js','dist/server.js','dist/utils/universalImporter.js'].forEach(f => { try { require('fs').chmodSync(f, 0o755); } catch (e) { console.warn('chmod skipped', f, e.message); } })\"",
     "prepublishOnly": "npm run build",