prism-mcp-server 20.21.6 → 20.21.7

package/dist/connect.js

@@ -1250,6 +1250,7 @@ function getHostDefinitions(homeDir, platform, env, includeSystemPaths) {
         label: "Gemini CLI",
         format: "json",
         configPath: join(homeDir, ".gemini", "settings.json"),
+        additionalConfigPaths: antigravityMcpConfigPaths(homeDir),
         detectionPaths: [join(homeDir, ".gemini")],
         executables: ["gemini"],
     }, {
@@ -1304,6 +1305,22 @@ function executableExists(name, platform, pathEnv) {
     }
     return false;
 }
+/**
+ * Antigravity has used three user-level MCP locations across releases. Keep
+ * the Gemini CLI settings registration as the primary result, and converge
+ * only Antigravity paths whose parent directory already exists. That avoids
+ * creating an unrelated host config on a Gemini-CLI-only installation while
+ * repairing an existing Antigravity installation, including the legacy IDE
+ * path that can otherwise continue launching an old server indefinitely.
+ */
+function antigravityMcpConfigPaths(homeDir) {
+    const geminiDir = join(homeDir, ".gemini");
+    return [
+        join(geminiDir, "config", "mcp_config.json"),
+        join(geminiDir, "antigravity", "mcp_config.json"),
+        join(geminiDir, "antigravity-ide", "mcp_config.json"),
+    ].filter((configPath) => existsSync(configPath) || existsSync(dirname(configPath)));
+}
 function buildMcpEntry(nodePath, serverPath, env) {
     const storage = env.PRISM_STORAGE ?? "auto";
     if (!CONNECT_STORAGE_BACKENDS.includes(storage)) {
@@ -1331,10 +1348,42 @@ function registerHost(definition, entry, dryRun, refresh, beforeCommit) {
     if (definition.configurationError) {
         return result(definition, "error", definition.configurationError);
     }
-    if (definition.format === "codex-toml") {
-        return registerCodexTomlHost(definition, entry, dryRun, refresh, beforeCommit);
+    const configDefinitions = [
+        definition,
+        ...(definition.additionalConfigPaths ?? []).map((configPath) => ({ ...definition, configPath })),
+    ];
+    const registerOne = (configDefinition) => {
+        if (configDefinition.format === "codex-toml") {
+            return registerCodexTomlHost(configDefinition, entry, dryRun, refresh, beforeCommit);
+        }
+        return registerJsonHost(configDefinition, entry, dryRun, refresh, beforeCommit);
+    };
+    const primary = registerOne(configDefinitions[0]);
+    if (primary.status === "error")
+        return primary;
+    const registrations = [primary, ...configDefinitions.slice(1).map(registerOne)];
+    const failures = registrations.slice(1).filter((registration) => registration.status === "error");
+    if (failures.length > 0) {
+        return {
+            ...primary,
+            status: "error",
+            startupCompatible: false,
+            message: `additional config registration failed: ${failures.map((failure) => `${failure.path}: ${failure.message || "unknown error"}`).join("; ")}`,
+        };
     }
-    return registerJsonHost(definition, entry, dryRun, refresh, beforeCommit);
+    const additionalChanges = registrations.slice(1).filter((registration) => registration.status !== "existing");
+    const incompatible = registrations.filter((registration) => !registration.startupCompatible);
+    const additionalMessage = additionalChanges.length > 0
+        ? `also ${additionalChanges.map((registration) => `${registration.status} ${registration.path}`).join(", ")}`
+        : undefined;
+    const incompatibleMessage = incompatible.length > 0
+        ? `retained incompatible or unmanaged registration(s): ${incompatible.map((registration) => registration.path).join(", ")}`
+        : undefined;
+    return {
+        ...primary,
+        startupCompatible: registrations.every((registration) => registration.startupCompatible),
+        message: [primary.message, additionalMessage, incompatibleMessage].filter(Boolean).join("; ") || undefined,
+    };
 }
 function registerJsonHost(definition, entry, dryRun, refresh, beforeCommit) {
     const { configPath } = definition;

package/dist/dashboard/dashboardToken.js

@@ -20,24 +20,30 @@ export function resolveDashboardToken(cfg) {
     return randomBytes(32).toString("hex");
 }
 /** Extract the prism_dashboard_token cookie value, if present. */
-export function tokenFromCookie(cookieHeader) {
+export function dashboardTokenCookieName(port) {
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new Error('Invalid dashboard port');
+    return `prism_dashboard_token_${port}`;
+}
+export function tokenFromCookie(cookieHeader, cookieName = 'prism_dashboard_token') {
     // Capture the whole value (any run of non-";", non-space) so pinned tokens
     // with hyphens/underscores match; the name is anchored to start-or-"; " so a
     // look-alike cookie (evil_prism_dashboard_token=…) cannot match.
-    const m = (cookieHeader || "").match(/(?:^|;\s*)prism_dashboard_token=([^;\s]+)/);
-    return m ? m[1] : null;
+    const entry = (cookieHeader || '').split(';').map(c => c.trim()).find(c => c.startsWith(`${cookieName}=`));
+    const value = entry?.slice(cookieName.length + 1);
+    return value && !/\s/.test(value) ? value : null;
 }
 /**
  * True when the request presents the active token via the cookie, the
  * X-Prism-Dashboard-Token header, or a ?token= query param. Every comparison is
  * timing-safe and only runs against the single active token.
  */
-export function requestHasToken(headers, queryToken, activeToken) {
-    const candidates = [tokenFromCookie(headers.cookie), headers.headerToken ?? null, queryToken];
+export function requestHasToken(headers, queryToken, activeToken, cookieName = 'prism_dashboard_token') {
+    const candidates = [tokenFromCookie(headers.cookie, cookieName), tokenFromCookie(headers.cookie), headers.headerToken ?? null, queryToken];
     return candidates.some((c) => c !== null && safeCompare(c, activeToken));
 }
 /** Build the Set-Cookie value that stores the token for a browser session. */
-export function buildTokenCookie(token, maxAgeMs, secure) {
-    return (`prism_dashboard_token=${token}; Path=/; HttpOnly; SameSite=Strict; ` +
+export function buildTokenCookie(token, maxAgeMs, secure, cookieName = 'prism_dashboard_token') {
+    return (`${cookieName}=${token}; Path=/; HttpOnly; SameSite=Strict; ` +
         `Max-Age=${Math.floor(maxAgeMs / 1000)}${secure ? "; Secure" : ""}`);
 }

package/dist/dashboard/graphRouter.js

@@ -65,16 +65,26 @@ export async function handleGraphRoutes(url, req, res, getStorageSafe) {
         else {
             params.limit = "200"; // Bump limit when exploring specific filters
         }
+        let createdAfter;
         if (project)
             params.project = `eq.${project}`;
         if (days) {
             const past = new Date();
             past.setDate(past.getDate() - parseInt(days, 10));
-            params.created_at = `gte.${past.toISOString()}`;
+            createdAfter = past.toISOString();
+            params.created_at = `gte.${createdAfter}`;
         }
         if (min_importance)
             params.importance = `gte.${parseInt(min_importance, 10)}`;
-        const entries = await s.getLedgerEntries(params);
+        const graphLimit = !project && !days && !min_importance ? 30 : 200;
+        const entries = s.getDashboardGraphEntries
+            ? await s.getDashboardGraphEntries({
+                ...(project ? { project } : {}),
+                ...(createdAfter ? { createdAfter } : {}),
+                ...(min_importance ? { minImportance: parseInt(min_importance, 10) } : {}),
+                limit: graphLimit,
+            })
+            : await s.getLedgerEntries(params);
         const now = Date.now();
         // ── Decay tracking: aggregate per-keyword and per-project ──
         // For each keyword/project, track the *freshest* entry's decay info

package/dist/dashboard/ledgerReader.js

@@ -0,0 +1,9 @@
+/** Paid clients have Portal credentials, not direct Supabase credentials. */
+export async function readDashboardLedger(storage, backend, project, order, limit) {
+    if (backend !== "synalux") {
+        return storage.getLedgerEntries({ project: `eq.${project}`, order, limit: String(limit) });
+    }
+    if (!storage.getDashboardLedger)
+        throw new Error("Cloud dashboard ledger reader unavailable");
+    return storage.getDashboardLedger(project, order, limit);
+}

package/dist/dashboard/server.js

@@ -22,7 +22,8 @@ import * as os from "os";
 import * as fs from "fs";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { createServer, getAllPossibleTools } from "../server.js";
-import { getStorage } from "../storage/index.js";
+import { getStorage, activeStorageBackend } from "../storage/index.js";
+import { readDashboardLedger } from "./ledgerReader.js";
 import { PRISM_USER_ID, SERVER_CONFIG } from "../config.js";
 import { renderDashboardHTML } from "./ui.js";
 import { computeIntentHealth } from "./intentHealth.js";
@@ -34,7 +35,7 @@ import { redactSettings } from "../tools/commonHelpers.js";
 import { handleGraphRoutes } from "./graphRouter.js";
 import { isDashboardSettingKeyAllowed, isDashboardSettingValueAllowed } from "./settingsPolicy.js";
 import { isTrustedRequest, isRebindGuardedPath } from "./hostGuard.js";
-import { resolveDashboardToken, requestHasToken, buildTokenCookie, } from "./dashboardToken.js";
+import { resolveDashboardToken, requestHasToken, buildTokenCookie, dashboardTokenCookieName, } from "./dashboardToken.js";
 import { safeCompare, generateToken, isAuthenticated, createRateLimiter, initJWKS, } from "./authUtils.js";
 const PORT = parseInt(process.env.PRISM_DASHBOARD_PORT || "3000", 10);
 /** Read HTTP request body as string (Buffer-based to avoid GC thrash on large imports) */
@@ -238,7 +239,7 @@ return false;}
                 reqUrl.searchParams.delete("token");
                 const cleanTarget = reqUrl.pathname + (reqUrl.search ? reqUrl.search : "");
                 res.writeHead(302, {
-                    "Set-Cookie": buildTokenCookie(DASHBOARD_TOKEN, SESSION_TTL_MS, COOKIE_SECURE),
+                    "Set-Cookie": buildTokenCookie(DASHBOARD_TOKEN, SESSION_TTL_MS, COOKIE_SECURE, dashboardTokenCookieName(req.socket.localPort)),
                     Location: cleanTarget,
                 });
                 return res.end();
@@ -247,7 +248,7 @@ return false;}
                 !requestHasToken({
                     cookie: req.headers.cookie,
                     headerToken: req.headers["x-prism-dashboard-token"] || null,
-                }, qToken, DASHBOARD_TOKEN)) {
+                }, qToken, DASHBOARD_TOKEN, dashboardTokenCookieName(req.socket.localPort))) {
                 res.writeHead(401, { "Content-Type": "application/json" });
                 return res.end(JSON.stringify({
                     error: "Dashboard token required — open the tokenized URL printed in the Prism startup log.",
@@ -482,11 +483,7 @@ return false;}
                     return res.end(JSON.stringify({ error: "Storage initializing..." }));
                 }
                 const context = await s.loadContext(projectName, "deep", PRISM_USER_ID);
-                const ledger = await s.getLedgerEntries({
-                    project: `eq.${projectName}`,
-                    order: "created_at.desc",
-                    limit: "20",
-                });
+                const ledger = await readDashboardLedger(s, activeStorageBackend, projectName, "created_at.desc", 20);
                 let history = [];
                 try {
                     history = await s.getHistory(projectName, PRISM_USER_ID, 10);
@@ -824,11 +821,7 @@ return false;}
                     }
                     // Gather data (mirrors sessionExportMemoryHandler)
                     const ctx = await s.loadContext(projectName, "deep", PRISM_USER_ID);
-                    const rawLedger = await s.getLedgerEntries({
-                        project: `eq.${projectName}`,
-                        order: "created_at.asc",
-                        limit: "1000",
-                    });
+                    const rawLedger = await readDashboardLedger(s, activeStorageBackend, projectName, "created_at.asc", 1000);
                     // Strip binary embedding fields
                     const cleanLedger = rawLedger.map(({ embedding: _e, embedding_compressed: _ec, ...rest }) => rest);
                     const rawSettings = await getAllSettings();

package/dist/dashboard/ui.js

@@ -712,6 +712,7 @@ export function renderDashboardHTML(version) {
         <button class="settings-btn" onclick="openSettings()" title="Settings">⚙️</button>
       </div>
     </header>
+    <p id="projectLoadError" role="alert" style="display:none; color:var(--accent-rose);"></p>
 
     <div class="main-tabs" style="display:flex; gap: 1rem; border-bottom: 1px solid var(--border-glass); margin-bottom: 1.5rem; padding-bottom: 0;">
       <button class="s-tab active" id="mtab-project" onclick="switchMainTab('project')" style="font-size: 1rem;">📁 Project View</button>
@@ -2049,6 +2050,7 @@ function loadIdentityChip() {
                     return [4 /*yield*/, res.json()];
                 case 2:
                     data = _a.sent();
+                    if (!res.ok) throw new Error(data.error || ('Request failed (' + res.status + ')'));
                     select = document.getElementById('projectSelect');
                     if (data.projects && data.projects.length > 0) {
                         select.innerHTML = '<option value="">— Select a project —</option>' +
@@ -2097,6 +2099,8 @@ function loadIdentityChip() {
                 case 3:
                     e_2 = _a.sent();
                     document.getElementById('projectSelect').innerHTML = '<option value="">Error loading projects</option>';
+                    document.getElementById('projectLoadError').textContent = e_2.message || 'Error loading projects';
+                    document.getElementById('projectLoadError').style.display = 'block';
                     return [3 /*break*/, 4];
                 case 4:
                     // Load identity chip once settings are available
@@ -2918,7 +2922,9 @@ function loadGraph() {
                     }
                     MAX_NODES = 200;
                     if (data.nodes.length > MAX_NODES) {
-                        priority = { project: 0, category: 1, keyword: 2 };
+                        // Keep the project/category/keyword ordering truthy because the
+                        // comparator falls back with a high priority for unknown groups.
+                        priority = { project: 1, category: 2, keyword: 3 };
                         data.nodes.sort(function (a, b) { return (priority[a.group] || 9) - (priority[b.group] || 9); });
                         kept = new Set(data.nodes.slice(0, MAX_NODES).map(function (n) { return n.id; }));
                         data.nodes = data.nodes.slice(0, MAX_NODES);

package/dist/storage/synalux.js

@@ -451,6 +451,46 @@ export class SynaluxStorage extends SupabaseStorage {
         const entries = Array.isArray(result.entries) ? result.entries : [];
         return entries;
     }
+    /**
+     * Read the bounded, authenticated ledger projection used by the dashboard
+     * graph. This is deliberately separate from getLedgerEntries: the latter
+     * has many PostgREST callers that are not representable by the portal API.
+     */
+    async getDashboardGraphEntries(params) {
+        if (!Number.isInteger(params.limit) || params.limit < 1 || params.limit > 200) {
+            throw new Error("Invalid dashboard graph limit");
+        }
+        if (params.project !== undefined && (!params.project.trim() || params.project.length > 100)) {
+            throw new Error("Invalid dashboard graph project");
+        }
+        if (params.createdAfter !== undefined
+            && (Number.isNaN(new Date(params.createdAfter).getTime())
+                || new Date(params.createdAfter).toISOString() !== params.createdAfter)) {
+            throw new Error("Invalid dashboard graph timestamp");
+        }
+        if (params.minImportance !== undefined
+            && (!Number.isInteger(params.minImportance)
+                || params.minImportance < -2147483648 || params.minImportance > 2147483647)) {
+            throw new Error("Invalid dashboard graph importance");
+        }
+        if (params.keywords !== undefined
+            && (params.keywords.length === 0 || params.keywords.length > 50
+                || params.keywords.some((keyword) => !keyword || keyword.length > 200))) {
+            throw new Error("Invalid dashboard graph keywords");
+        }
+        const result = await this.portalPost("/api/v1/prism/memory", {
+            action: "dashboard_ledger",
+            ...(params.project !== undefined ? { project: params.project.trim() } : {}),
+            ...(params.createdAfter !== undefined ? { created_after: params.createdAfter } : {}),
+            ...(params.minImportance !== undefined ? { min_importance: params.minImportance } : {}),
+            ...(params.keywords !== undefined ? { keywords: params.keywords } : {}),
+            limit: params.limit,
+        });
+        if (!Array.isArray(result.ledger)) {
+            throw new Error("Dashboard graph contract drift: ledger[] is required");
+        }
+        return result.ledger;
+    }
     // ─── Project inventory + export ──────────────────────────────
     // Both portal actions shipped in Phase 3 but the client was never
     // wired: listProjects and the export path fell through to
@@ -503,6 +543,32 @@ export class SynaluxStorage extends SupabaseStorage {
         }
         return rows;
     }
+    /** Read the requested dashboard window without the backup's 10k-row cap. */
+    async getDashboardLedger(project, order, limit) {
+        if (!Number.isInteger(limit) || limit < 1 || limit > 1000)
+            throw new Error("Invalid dashboard ledger limit");
+        let offset = 0;
+        for (let attempt = 0; attempt < 4; attempt++) {
+            const result = await this.portalPost("/api/v1/prism/memory", {
+                action: "export_memory", project, offset, limit,
+            });
+            const page = result.page;
+            const total = page?.total;
+            if (!Array.isArray(result.ledger) || typeof total !== "number" || !Number.isSafeInteger(total) || total < 0) {
+                throw new Error("Dashboard export contract drift: ledger and total are required");
+            }
+            const target = order === "created_at.desc" ? Math.max(0, total - limit) : 0;
+            if (offset !== target) {
+                offset = target;
+                continue;
+            }
+            const rows = result.ledger;
+            const direction = order === "created_at.asc" ? 1 : -1;
+            return [...rows].sort((a, b) => direction * (String(a.created_at).localeCompare(String(b.created_at))
+                || String(a.id).localeCompare(String(b.id))));
+        }
+        throw new Error("Dashboard ledger changed during read; retry");
+    }
     // ─── Time Travel ─────────────────────────────────────────────
     // Phase 3 Tier B: route memory_history through portal instead of
     // falling through to SupabaseStorage (which requires a direct

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.6",
+  "version": "20.21.7",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine \u2014 including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",