prism-mcp-server 20.21.0 → 20.21.2

package/dist/cli.js

@@ -223,6 +223,17 @@ program
     .option('--no-models', 'Skip model convergence; keep whatever model versions are installed')
     .action(async (options) => {
     try {
+        // Take the subscription key from the settings store when the environment
+        // does not carry it. connect writes into each host's MCP env block only
+        // what it can see, so without this a machine that logged in once lost its
+        // subscription on the next re-registration and every search fell through
+        // to a Brave key in the server's own environment, which a host launched
+        // from the graphical shell does not carry.
+        {
+            const { hydrateSynaluxCredentials } = await import('./utils/synaluxSearch.js');
+            const { getSetting } = await import('./storage/configStorage.js');
+            await hydrateSynaluxCredentials(getSetting);
+        }
         // ── Converge the PACKAGE first, then the configs ──────────────
         // connect is the one command the operator runs to make a machine
         // current; leaving it configuring with stale code produced the

package/dist/connect.js

@@ -1163,6 +1163,9 @@ function buildMcpEntry(nodePath, serverPath, env) {
         PRISM_SYNALUX_BASE_URL: env.PRISM_SYNALUX_BASE_URL || "https://synalux.ai",
         PRISM_STORAGE: storage,
     };
+    // process.env is hydrated from the settings store before connect runs, so a
+    // machine that logged in once keeps its subscription across re-registration
+    // instead of silently dropping to unauthenticated search.
     if (env.PRISM_SYNALUX_API_KEY) {
         serverEnv.PRISM_SYNALUX_API_KEY = env.PRISM_SYNALUX_API_KEY;
     }

package/dist/scholar/webScholar.js

@@ -12,7 +12,7 @@ import { searchYahooFree, scrapeArticleLocal } from "./freeSearch.js";
 // The same capability flag performWebSearchRaw itself branches on, imported
 // from the same module so the gate and the transport cannot disagree about
 // whether a web search is possible.
-import { SYNALUX_SEARCH_AVAILABLE } from "../utils/synaluxSearch.js";
+import { synaluxSearchAvailable } from "../utils/synaluxSearch.js";
 // ─── Hivemind Integration Helpers ────────────────────────────
 const SCHOLAR_PROJECT = "prism-scholar";
 const SCHOLAR_ROLE = "scholar";
@@ -208,7 +208,7 @@ export async function runWebScholar(overrideTopic, overrideProject) {
         //
         // Google Custom Search used to take priority over both; now removed
         // because Google discontinues that API on 2027-01-01.
-        const useWebSearch = SYNALUX_SEARCH_AVAILABLE || !!BRAVE_API_KEY;
+        const useWebSearch = synaluxSearchAvailable() || !!BRAVE_API_KEY;
         const topic = overrideTopic || await selectTopic();
         const project = overrideProject || SCHOLAR_PROJECT;
         if (!topic) {

package/dist/server.js

@@ -76,9 +76,10 @@ import { SKILL_SAVE_TOOL, SKILL_MANAGE_TOOL, skillSaveHandler, skillManageHandle
 // error wrapper. Now uses getStorage() which routes through the
 // correct backend (Supabase or SQLite) with proper error handling.
 import { getStorage } from "./storage/index.js";
-import { getSettingSync, initConfigStorage } from "./storage/configStorage.js";
+import { getSetting, getSettingSync, initConfigStorage } from "./storage/configStorage.js";
 import { sanitizeMcpOutput } from "./utils/sanitizer.js";
-import { sanitizeForLog } from "./utils/logger.js";
+import { debugLog, sanitizeForLog } from "./utils/logger.js";
+import { hydrateSynaluxCredentials } from "./utils/synaluxSearch.js";
 import { getTracer, initTelemetry } from "./utils/telemetry.js";
 import { context as otelContext, trace, SpanStatusCode } from "@opentelemetry/api";
 import { ddInfo, ddError as ddLogError } from "./utils/ddLogger.js";
@@ -1290,6 +1291,18 @@ export async function startServer() {
     // synchronously. This is a synchronous call — no await needed.
     // No-op when otel_enabled=false (the default).
     initTelemetry();
+    // Put the subscription key in process.env before anything asks whether the
+    // portal is reachable. `prism connect` copies it into the host's MCP env
+    // block only if it was in the environment when connect ran; otherwise it is
+    // in the settings store, and a paid subscriber's searches were failing on a
+    // Brave key in the server's own environment, which a host launched from the
+    // graphical shell does not carry.
+    // getSetting reads the cache initConfigStorage() just warmed, so this adds
+    // no I/O to the path the Initialize handshake waits on.
+    const portalSearchReady = await hydrateSynaluxCredentials(getSetting);
+    if (!portalSearchReady) {
+        debugLog("[Prism] no Synalux subscription key in the environment or the settings store — search falls back to BRAVE_API_KEY");
+    }
     const server = createServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/dist/storage/index.js

@@ -2,6 +2,7 @@ import { PRISM_STORAGE as ENV_PRISM_STORAGE, SUPABASE_CONFIGURED, SYNALUX_CONFIG
 import { debugLog } from "../utils/logger.js";
 import { SupabaseStorage } from "./supabase.js";
 import { getSetting } from "./configStorage.js";
+import { upgradeInsecureCloudUrl } from "../utils/secureUrl.js";
 export function isValidHttpUrl(url) {
     try {
         const parsed = new URL(url);
@@ -42,23 +43,7 @@ export function isValidHttpUrl(url) {
  * listener the connection fails afterwards, and the log line is what explains
  * why.
  */
-export function upgradeInsecureCloudUrl(raw) {
-    try {
-        const parsed = new URL(raw);
-        if (parsed.protocol !== "http:")
-            return raw;
-        const host = parsed.hostname;
-        if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]")
-            return raw;
-        parsed.protocol = "https:";
-        const upgraded = parsed.toString().replace(/\/+$/, "");
-        debugLog(`[Prism Storage] Upgraded ${raw} to ${upgraded}: session content is never sent over plaintext to a remote host.`);
-        return upgraded;
-    }
-    catch {
-        return raw;
-    }
-}
+export { upgradeInsecureCloudUrl } from "../utils/secureUrl.js";
 /**
  * Probe for synalux credentials: env vars first, then config DB.
  * Returns true if usable credentials are now in process.env.

package/dist/utils/braveApi.js

@@ -31,7 +31,7 @@
 import { BRAVE_API_KEY, BRAVE_ANSWERS_API_KEY } from "../config.js";
 import { debugLog } from "./logger.js";
 import { isPortalPlanRefusal } from "./portalError.js";
-import { SYNALUX_SEARCH_AVAILABLE, synaluxWebSearch, synaluxWebSearchRaw, synaluxLocalSearch, synaluxLocalSearchRaw, synaluxBraveAnswers, } from "./synaluxSearch.js";
+import { synaluxSearchAvailable, synaluxWebSearch, synaluxWebSearchRaw, synaluxLocalSearch, synaluxLocalSearchRaw, synaluxBraveAnswers, } from "./synaluxSearch.js";
 const BRAVE_API_KEY_MISSING_ERROR = "BRAVE_API_KEY is not configured";
 const BRAVE_ANSWERS_API_KEY_MISSING_ERROR = "BRAVE_ANSWERS_API_KEY is not configured";
 const SYNALUX_OFFSET_UNSUPPORTED_ERROR = "Configured Synalux search does not support search offsets";
@@ -65,7 +65,7 @@ async function portalFirst(viaPortal, ownKey, viaOwnKey) {
 }
 // Brave Answers API call (AI Grounding/OpenAI-compatible)
 export async function performBraveAnswers(query, model = "brave") {
-    if (SYNALUX_SEARCH_AVAILABLE) {
+    if (synaluxSearchAvailable()) {
         return portalFirst(() => synaluxBraveAnswers(query, model), BRAVE_ANSWERS_API_KEY, () => braveAnswersDirect(query, model));
     }
     return braveAnswersDirect(query, model);
@@ -102,7 +102,7 @@ async function braveAnswersDirect(query, model) {
 }
 // Raw web search API call
 export async function performWebSearchRaw(query, count = 10, offset = 0) {
-    if (SYNALUX_SEARCH_AVAILABLE) {
+    if (synaluxSearchAvailable()) {
         if (offset !== 0)
             throw new Error(SYNALUX_OFFSET_UNSUPPORTED_ERROR);
         return portalFirst(() => synaluxWebSearchRaw(query, count), BRAVE_API_KEY, () => braveWebSearchRaw(query, count, offset));
@@ -131,7 +131,7 @@ async function braveWebSearchRaw(query, count, offset) {
 }
 // Web search API call
 export async function performWebSearch(query, count = 10, offset = 0) {
-    if (SYNALUX_SEARCH_AVAILABLE) {
+    if (synaluxSearchAvailable()) {
         if (offset !== 0)
             throw new Error(SYNALUX_OFFSET_UNSUPPORTED_ERROR);
         return portalFirst(() => synaluxWebSearch(query, count), BRAVE_API_KEY, () => braveWebSearch(query, count, offset));
@@ -197,7 +197,7 @@ function chunkArray(arr, size) {
 }
 // Raw local search API call with poi/details payload
 export async function performLocalSearchRaw(query, count = 5) {
-    if (SYNALUX_SEARCH_AVAILABLE) {
+    if (synaluxSearchAvailable()) {
         return portalFirst(() => synaluxLocalSearchRaw(query, count), BRAVE_API_KEY, () => braveLocalSearchRaw(query, count));
     }
     return braveLocalSearchRaw(query, count);
@@ -260,7 +260,7 @@ async function braveLocalSearchRaw(query, count) {
 }
 // Local search API call with poi details
 export async function performLocalSearch(query, count = 5) {
-    if (SYNALUX_SEARCH_AVAILABLE) {
+    if (synaluxSearchAvailable()) {
         return portalFirst(() => synaluxLocalSearch(query, count), BRAVE_API_KEY, () => braveLocalSearch(query, count));
     }
     return braveLocalSearch(query, count);
@@ -278,20 +278,29 @@ async function braveLocalSearch(query, count) {
 export function formatLocalResults(poisData, descData) {
     return ((poisData.results || [])
         .map((poi) => {
-        const address = [
-            poi.address?.streetAddress ?? "",
-            poi.address?.addressLocality ?? "",
-            poi.address?.addressRegion ?? "",
-            poi.address?.postalCode ?? "",
-        ]
-            .filter((part) => part !== "")
-            .join(", ") || "N/A";
-        return `Name: ${poi.name || poi.title || "N/A"}
+        // Brave sends postal_address.displayAddress, contact.telephone and
+        // opening_hours. The streetAddress/phone/openingHours shapes below have
+        // never appeared on a POI, which is why every venue came back N/A while
+        // the name resolved through the title fallback. Measured 2026-09-16.
+        const today = poi.opening_hours?.current_day?.[0];
+        const hours = (poi.openingHours || []).join(", ")
+            || (today?.opens && today?.closes ? `${today.opens}-${today.closes}` : "")
+            || "N/A";
+        const address = poi.postal_address?.displayAddress ||
+            [
+                poi.address?.streetAddress ?? "",
+                poi.address?.addressLocality ?? "",
+                poi.address?.addressRegion ?? "",
+                poi.address?.postalCode ?? "",
+            ]
+                .filter((part) => part !== "")
+                .join(", ") || "N/A";
+        return `Name: ${poi.title || poi.name || "N/A"}
 Address: ${address}
-Phone: ${poi.phone || "N/A"}
-Rating: ${poi.rating?.ratingValue ?? "N/A"} (${poi.rating?.ratingCount ?? 0} reviews)
-Price Range: ${poi.priceRange || "N/A"}
-Hours: ${(poi.openingHours || []).join(", ") || "N/A"}
+Phone: ${poi.contact?.telephone || poi.phone || "N/A"}
+Rating: ${poi.rating?.ratingValue ?? "N/A"} (${poi.rating?.reviewCount ?? poi.rating?.ratingCount ?? 0} reviews)
+Price Range: ${poi.price_range || poi.priceRange || "N/A"}
+Hours: ${hours}
 Description: ${descData.descriptions[poi.id] || "No description available"}
 `;
     })

package/dist/utils/entitlements.js

@@ -9,8 +9,9 @@
  * Authenticated users get their plan from the portal (5-minute cache).
  */
 import { getSynaluxJwt } from "./synaluxJwt.js";
-import { PRISM_SYNALUX_BASE_URL, SYNALUX_CONFIGURED } from "../config.js";
+import { SYNALUX_CONFIGURED } from "../config.js";
 import { debugLog } from "./logger.js";
+import { resolvePortalBaseUrl, usablePortalKey } from "./synaluxSearch.js";
 /** What a host with NO portal (unconfigured), a portal that says nothing
  *  (older deployment), or an assumed-free fallback gets: OFF. Multi-turn is
  *  a paid-plan feature (owner decision 2026-09-15); a client default that
@@ -101,10 +102,13 @@ export function clampCeiling(requested, planCeiling) {
 }
 // ── Fetch ─────────────────────────────────────────────────────────
 async function fetchEntitlements() {
-    // Re-read process.env because dashboard/bootstrap configuration can inject
-    // credentials after config.ts captured its module-load constants.
-    const baseUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() || PRISM_SYNALUX_BASE_URL;
-    const apiKey = process.env.PRISM_SYNALUX_API_KEY?.trim();
+    // Resolve through the SAME helper the search client uses. These two answered
+    // "is the portal usable" differently before: entitlements ignored the legacy
+    // SYNALUX_BASE_URL alias, accepted an unexpanded ${...} template, and never
+    // checked the value was a URL, so a host whose alias arrived after load had
+    // working search and a free-tier plan. Measured 2026-09-16.
+    const baseUrl = resolvePortalBaseUrl();
+    const apiKey = usablePortalKey();
     if ((!SYNALUX_CONFIGURED && !apiKey) || !baseUrl) {
         debugLog("[entitlements] no Synalux auth configured — free tier");
         return { ...FREE_ENTITLEMENTS, source: "unconfigured" };

package/dist/utils/secureUrl.js

@@ -0,0 +1,30 @@
+/**
+ * One definition of "never send this over plaintext".
+ *
+ * This lived inside storage/index.ts, so only the storage path applied it. When
+ * startup hydration began publishing PRISM_SYNALUX_BASE_URL from the settings
+ * store, it bypassed the control entirely: a self-hosted portal stored as
+ * `http://portal.internal.example` was published unchanged, and the search
+ * client then POSTed the query plus `Authorization: Bearer <JWT>` to it in the
+ * clear. Measured 2026-09-16.
+ *
+ * Loopback is exempt because there is no network to intercept.
+ */
+import { debugLog } from "./logger.js";
+export function upgradeInsecureCloudUrl(raw) {
+    try {
+        const parsed = new URL(raw);
+        if (parsed.protocol !== "http:")
+            return raw;
+        const host = parsed.hostname;
+        if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]")
+            return raw;
+        parsed.protocol = "https:";
+        const upgraded = parsed.toString().replace(/\/+$/, "");
+        debugLog(`[Prism] Upgraded ${raw} to ${upgraded}: content is never sent over plaintext to a remote host.`);
+        return upgraded;
+    }
+    catch {
+        return raw;
+    }
+}

package/dist/utils/synaluxSearch.js

@@ -14,22 +14,113 @@
  * Auth uses the shared JWT exchange from synaluxJwt.ts (same
  * refresh-token dance as SynaluxStorage, but without requiring
  * the full storage class). Falls back gracefully: callers check
- * SYNALUX_SEARCH_AVAILABLE before calling.
+ * synaluxSearchAvailable() before calling.
  */
 import { debugLog } from "./logger.js";
+import { upgradeInsecureCloudUrl } from "./secureUrl.js";
 import { PortalHttpError } from "./portalError.js";
 import { getSynaluxJwt, invalidateSynaluxJwt } from "./synaluxJwt.js";
-import { PRISM_SYNALUX_BASE_URL, SYNALUX_CONFIGURED, } from "../config.js";
+import { PRISM_SYNALUX_API_KEY, PRISM_SYNALUX_BASE_URL, } from "../config.js";
 // ─── Public availability flag ────────────────────────────────
-/** True when Synalux portal credentials are configured. */
-export const SYNALUX_SEARCH_AVAILABLE = SYNALUX_CONFIGURED;
+/** A `${...}` template the shell never expanded is not a credential. config.ts
+ *  rejects those at load; the live read rejects them too, or a half-written host
+ *  config sends every search to a portal that can only answer 401. */
+function usableEnvValue(raw) {
+    const trimmed = raw?.trim();
+    if (!trimmed || trimmed.includes("${"))
+        return undefined;
+    return trimmed;
+}
+function isHttpUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "http:" || parsed.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether the portal can serve a search, resolved at CALL time.
+ *
+ *  This used to be a module-load constant taken from SYNALUX_CONFIGURED, and
+ *  that was wrong for the most common installation. `prism connect` copies the
+ *  subscription key into the host's MCP env block only when the key already
+ *  happened to be in the environment; otherwise it lives in Prism's settings
+ *  store and reaches process.env during startup. A constant read before that
+ *  froze "unconfigured" for the life of the process, so a paying subscriber's
+ *  every search skipped the portal and demanded a Brave key they had no reason
+ *  to own — while entitlements, resolved later from the same hydrated key,
+ *  correctly reported their paid plan. Measured 2026-09-16.
+ *
+ *  The resolution order below is deliberately the same one fetchEntitlements()
+ *  uses (live env first, module-load constant as the fallback). Search and
+ *  entitlements answering "is the portal usable" differently IS the defect. */
+export function resolvePortalBaseUrl() {
+    // Each candidate is validated in turn: a typo in one host config must fall
+    // through to the settings store rather than disabling portal search outright.
+    for (const candidate of [
+        usableEnvValue(process.env.PRISM_SYNALUX_BASE_URL),
+        usableEnvValue(process.env.SYNALUX_BASE_URL),
+        PRISM_SYNALUX_BASE_URL,
+    ]) {
+        if (!candidate || !isHttpUrl(candidate))
+            continue;
+        // Never hand back a cleartext transport URL for a remote host: this client
+        // sends the query and a bearer JWT over it.
+        return upgradeInsecureCloudUrl(candidate).replace(/\/+$/, "");
+    }
+    return undefined;
+}
+/** The subscription key, resolved the one way every portal client resolves it. */
+export function usablePortalKey() {
+    return usableEnvValue(process.env.PRISM_SYNALUX_API_KEY) ?? PRISM_SYNALUX_API_KEY;
+}
+export function synaluxSearchAvailable() {
+    return !!resolvePortalBaseUrl() && !!usablePortalKey();
+}
+/** Put the subscription key where every consumer reads it — process.env —
+ *  taking the settings store as the fallback source. Idempotent, and it never
+ *  overwrites a value the environment already supplied. */
+export async function hydrateSynaluxCredentials(getSetting) {
+    try {
+        const baseUrl = usableEnvValue(process.env.PRISM_SYNALUX_BASE_URL)
+            ?? usableEnvValue(process.env.SYNALUX_BASE_URL)
+            ?? usableEnvValue(await getSetting("PRISM_SYNALUX_BASE_URL", ""))
+            ?? usableEnvValue(await getSetting("SYNALUX_BASE_URL", ""))
+            ?? PRISM_SYNALUX_BASE_URL;
+        // Validate AND secure before publishing. process.env is shared with storage
+        // and entitlements, so a settings row holding a non-URL would poison every
+        // portal client in the process — and a cleartext http:// row would put the
+        // bearer JWT of every one of them on the wire in the clear.
+        if (baseUrl && isHttpUrl(baseUrl)) {
+            process.env.PRISM_SYNALUX_BASE_URL =
+                upgradeInsecureCloudUrl(baseUrl).replace(/\/+$/, "");
+        }
+        const apiKey = usableEnvValue(process.env.PRISM_SYNALUX_API_KEY)
+            ?? usableEnvValue(await getSetting("PRISM_SYNALUX_API_KEY", ""))
+            ?? PRISM_SYNALUX_API_KEY;
+        if (apiKey)
+            process.env.PRISM_SYNALUX_API_KEY = apiKey;
+        return synaluxSearchAvailable();
+    }
+    catch {
+        return synaluxSearchAvailable(); // a settings read must never break startup
+    }
+}
 // ─── Internal helpers ────────────────────────────────────────
 /**
  * POST to a portal endpoint with JWT auth. Retries once on 401
  * (JWT may have just expired). Throws on network or HTTP errors.
  */
 async function portalPost(path, body, timeoutMs = 15_000) {
-    const baseUrl = PRISM_SYNALUX_BASE_URL.replace(/\/+$/, "");
+    // Resolved, never the module-load constant: availability is now decided from
+    // the live environment, so a portal that is reachable must also be addressable.
+    // Reading a frozen constant here would throw on the very installation this
+    // routing exists to serve.
+    const baseUrl = resolvePortalBaseUrl();
+    if (!baseUrl) {
+        throw new Error("[synaluxSearch] no Synalux portal base URL is configured");
+    }
     const url = `${baseUrl}${path}`;
     const send = async (jwt) => {
         return fetch(url, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.0",
+  "version": "20.21.2",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",