prism-mcp-server 20.21.7 → 20.21.8

package/README.md

@@ -149,6 +149,23 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.8
+
+### Dashboard graphs use the authenticated Portal
+
+- The selected cloud project now shows its real session nodes and stored links
+  instead of collapsing to a keyword-only project bubble.
+- **Synthesize Edges** uses the authenticated Synalux Portal embedding contract;
+  the Prism dashboard process does not need a Google or Gemini API key.
+- Existing vectors and links are reused on repeat runs, synthesis fan-out is
+  bounded, and Portal failures are shown rather than rendered as an empty graph.
+- **Account & Settings** now shows the current user, role, and Free, Standard,
+  Advanced, or Enterprise plan, with visible sign-in, upgrade, billing, and
+  sign-out actions.
+- A selected paid plan survives the Portal sign-in round trip, live and test
+  Stripe catalogs resolve every paid tier, and localized checkout never reuses
+  a USD Price for another currency.
+
 ## What's New in v20.18.1
 
 ### Task skills survive compaction and update in place

package/dist/dashboard/accountRouter.js

@@ -0,0 +1,328 @@
+import { invalidateEntitlements } from "../utils/entitlements.js";
+import { getSynaluxJwt, invalidateSynaluxJwt } from "../utils/synaluxJwt.js";
+import { resolvePortalBaseUrl, usablePortalKey } from "../utils/synaluxSearch.js";
+import { isSynaluxSignedOut, setSynaluxSignedOut } from "../utils/synaluxCredentialState.js";
+import { upgradeInsecureCloudUrl } from "../utils/secureUrl.js";
+const DEFAULT_PORTAL_URL = "https://synalux.ai";
+const MAX_BODY_BYTES = 16 * 1024;
+const VALID_PLANS = new Set(["free", "standard", "advanced", "enterprise"]);
+let accountMutationQueue = Promise.resolve();
+async function serializeAccountMutation(operation) {
+    const previous = accountMutationQueue;
+    let release;
+    accountMutationQueue = new Promise((resolve) => { release = resolve; });
+    await previous.catch(() => { });
+    try {
+        return await operation();
+    }
+    finally {
+        release();
+    }
+}
+const defaultDeps = {
+    fetcher: fetch,
+    getSetting: async (key, defaultValue) => (await import("../storage/configStorage.js")).getSetting(key, defaultValue),
+    setSetting: async (key, value) => (await import("../storage/configStorage.js")).setSetting(key, value),
+    getJwt: getSynaluxJwt,
+    invalidateJwt: invalidateSynaluxJwt,
+    invalidateEntitlements,
+    closeStorage: async () => (await import("../storage/index.js")).closeStorage(),
+    resolvePortalBaseUrl,
+    usablePortalKey,
+};
+function json(res, status, body) {
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        "Cache-Control": "private, no-store",
+    });
+    res.end(JSON.stringify(body));
+}
+async function readJson(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.length;
+        if (total > MAX_BODY_BYTES)
+            throw new Error("Request body too large");
+        chunks.push(buffer);
+    }
+    const raw = Buffer.concat(chunks).toString("utf8");
+    if (!raw)
+        return {};
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Body must be a JSON object");
+    }
+    return value;
+}
+function safePortalOrigin(raw) {
+    if (!raw)
+        return null;
+    try {
+        const upgraded = upgradeInsecureCloudUrl(raw.trim());
+        const parsed = new URL(upgraded);
+        if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && ["localhost", "127.0.0.1", "::1", "[::1]"].includes(parsed.hostname))) {
+            return null;
+        }
+        return parsed.origin;
+    }
+    catch {
+        return null;
+    }
+}
+async function portalOrigin(deps) {
+    return safePortalOrigin(deps.resolvePortalBaseUrl())
+        ?? safePortalOrigin(await deps.getSetting("PRISM_SYNALUX_BASE_URL", ""))
+        ?? safePortalOrigin(await deps.getSetting("SYNALUX_BASE_URL", ""))
+        ?? DEFAULT_PORTAL_URL;
+}
+async function applyStoredSignOut(deps) {
+    const signedOut = (await deps.getSetting("PRISM_SYNALUX_SIGNED_OUT", "")) === "true";
+    setSynaluxSignedOut(signedOut);
+    if (signedOut)
+        delete process.env.PRISM_SYNALUX_API_KEY;
+    return signedOut;
+}
+function authUrl(origin) {
+    return `${origin}/auth?source=prism`;
+}
+function signedOutAccount(origin) {
+    return {
+        signed_in: false,
+        configured: false,
+        name: null,
+        role_key: null,
+        plan: "free",
+        billing: { action: "upgrade", url: `${origin}/pricing` },
+        auth_url: authUrl(origin),
+    };
+}
+function normalizeAccount(value, origin) {
+    if (!value || typeof value !== "object")
+        throw new Error("Portal returned an invalid account response");
+    const raw = value;
+    const plan = typeof raw.plan === "string" && VALID_PLANS.has(raw.plan) ? raw.plan : "free";
+    const billingRaw = raw.billing && typeof raw.billing === "object"
+        ? raw.billing
+        : {};
+    const action = billingRaw.action === "manage" || billingRaw.action === "included"
+        ? billingRaw.action
+        : "upgrade";
+    const url = typeof billingRaw.url === "string" && isAllowedBillingUrl(billingRaw.url, origin)
+        ? billingRaw.url
+        : null;
+    return {
+        signed_in: raw.signed_in === true,
+        configured: true,
+        name: typeof raw.name === "string" ? raw.name.slice(0, 160) : null,
+        role_key: typeof raw.role_key === "string" ? raw.role_key.slice(0, 80) : null,
+        plan: plan,
+        plan_source: raw.plan_source === "managed" ? "managed" : "stripe",
+        billing: { action, url },
+        auth_url: authUrl(origin),
+    };
+}
+function isAllowedBillingUrl(raw, origin) {
+    try {
+        const url = new URL(raw);
+        return url.origin === origin
+            || (url.protocol === "https:" && url.hostname === "billing.stripe.com");
+    }
+    catch {
+        return false;
+    }
+}
+async function accountWithJwt(deps, origin) {
+    let jwt = await deps.getJwt();
+    if (!jwt || isSynaluxSignedOut())
+        throw new Error("Synalux sign-in expired. Sign in again.");
+    const send = (token) => deps.fetcher(`${origin}/api/v1/prism/account`, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${token}`, "X-Prism-Client": "prism-dashboard" },
+        signal: AbortSignal.timeout(10_000),
+        redirect: "error",
+    });
+    let response = await send(jwt);
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    if (response.status === 401) {
+        deps.invalidateJwt();
+        jwt = await deps.getJwt();
+        if (!jwt)
+            throw new Error("Synalux sign-in expired. Sign in again.");
+        response = await send(jwt);
+        if (isSynaluxSignedOut())
+            throw new Error("Synalux account is signed out");
+    }
+    if (!response.ok)
+        throw new Error(`Unable to load Synalux account (HTTP ${response.status})`);
+    const data = await response.json();
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    return normalizeAccount(data, origin);
+}
+export async function loadDashboardAccount(overrides = {}) {
+    const deps = { ...defaultDeps, ...overrides };
+    const origin = await portalOrigin(deps);
+    if (await applyStoredSignOut(deps))
+        return signedOutAccount(origin);
+    if (!deps.usablePortalKey())
+        return signedOutAccount(origin);
+    return accountWithJwt(deps, origin);
+}
+async function revokeRawToken(deps, origin, token) {
+    try {
+        const response = await deps.fetcher(`${origin}/api/v1/prism/account`, {
+            method: "DELETE",
+            headers: { Authorization: `Bearer ${token}`, "X-Prism-Client": "prism-dashboard" },
+            signal: AbortSignal.timeout(10_000),
+            redirect: "error",
+        });
+        return response.ok || response.status === 401;
+    }
+    catch {
+        return false;
+    }
+}
+export async function connectDashboardAccount(code, overrides = {}) {
+    return serializeAccountMutation(async () => {
+        const deps = { ...defaultDeps, ...overrides };
+        if (typeof code !== "string" || !code.startsWith("synalux_code_") || code.length > 256) {
+            throw new Error("Enter a valid one-time Prism sign-in code");
+        }
+        const origin = await portalOrigin(deps);
+        const response = await deps.fetcher(`${origin}/api/v1/auth/code-exchange`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Prism-Client": "prism-dashboard" },
+            body: JSON.stringify({ code, client: "prism" }),
+            signal: AbortSignal.timeout(10_000),
+            redirect: "error",
+        });
+        const data = await response.json().catch(() => ({}));
+        if (!response.ok)
+            throw new Error(typeof data.error === "string" ? data.error : "Prism sign-in failed");
+        const token = typeof data.api_token === "string" ? data.api_token : "";
+        if (!token.startsWith("synalux_sk_") || token.length > 512) {
+            throw new Error("Portal returned an invalid Prism credential");
+        }
+        try {
+            await deps.setSetting("PRISM_SYNALUX_BASE_URL", origin);
+            await deps.setSetting("PRISM_SYNALUX_API_KEY", token);
+            await deps.setSetting("PRISM_SYNALUX_SIGNED_OUT", "false");
+        }
+        catch (error) {
+            await revokeRawToken(deps, origin, token);
+            await deps.setSetting("PRISM_SYNALUX_SIGNED_OUT", "true").catch(() => { });
+            await deps.setSetting("PRISM_SYNALUX_API_KEY", "").catch(() => { });
+            throw new Error(`Could not save Prism sign-in: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        setSynaluxSignedOut(false);
+        process.env.PRISM_SYNALUX_BASE_URL = origin;
+        process.env.PRISM_SYNALUX_API_KEY = token;
+        deps.invalidateJwt();
+        deps.invalidateEntitlements();
+        await deps.closeStorage();
+        return accountWithJwt(deps, origin);
+    });
+}
+export async function openDashboardBilling(overrides = {}) {
+    const deps = { ...defaultDeps, ...overrides };
+    const origin = await portalOrigin(deps);
+    if (await applyStoredSignOut(deps) || !deps.usablePortalKey()) {
+        return { url: `${origin}/pricing`, action: "upgrade" };
+    }
+    let jwt = await deps.getJwt();
+    if (!jwt || isSynaluxSignedOut())
+        throw new Error("Synalux sign-in expired. Sign in again.");
+    const send = (token) => deps.fetcher(`${origin}/api/v1/prism/account`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, "X-Prism-Client": "prism-dashboard" },
+        signal: AbortSignal.timeout(10_000),
+        redirect: "error",
+    });
+    let response = await send(jwt);
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    if (response.status === 401) {
+        deps.invalidateJwt();
+        jwt = await deps.getJwt();
+        if (!jwt)
+            throw new Error("Synalux sign-in expired. Sign in again.");
+        response = await send(jwt);
+        if (isSynaluxSignedOut())
+            throw new Error("Synalux account is signed out");
+    }
+    const data = await response.json().catch(() => ({}));
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    if (!response.ok)
+        throw new Error(typeof data.error === "string" ? data.error : `Billing unavailable (HTTP ${response.status})`);
+    if (typeof data.url !== "string" || !isAllowedBillingUrl(data.url, origin)) {
+        throw new Error("Portal returned an unsafe billing URL");
+    }
+    return { url: data.url, action: typeof data.action === "string" ? data.action : "manage" };
+}
+export async function signOutDashboardAccount(overrides = {}) {
+    return serializeAccountMutation(async () => {
+        const deps = { ...defaultDeps, ...overrides };
+        const origin = await portalOrigin(deps);
+        const token = deps.usablePortalKey() ?? (await deps.getSetting("PRISM_SYNALUX_API_KEY", "")).trim();
+        // Cut off every local credential path before waiting on the network. The
+        // storage singleton captures its refresh token at construction, so clearing
+        // only process.env would leave an already-created backend signed in.
+        setSynaluxSignedOut(true);
+        delete process.env.PRISM_SYNALUX_API_KEY;
+        deps.invalidateJwt();
+        deps.invalidateEntitlements();
+        await deps.setSetting("PRISM_SYNALUX_SIGNED_OUT", "true");
+        await deps.setSetting("PRISM_SYNALUX_API_KEY", "");
+        await deps.closeStorage();
+        const revoked = token ? await revokeRawToken(deps, origin, token) : true;
+        return { signed_out: true, revoked };
+    });
+}
+export async function handleAccountRoutes(url, req, res) {
+    if (url.pathname === "/api/account" && req.method === "GET") {
+        try {
+            json(res, 200, await loadDashboardAccount());
+        }
+        catch (error) {
+            json(res, 502, { error: error instanceof Error ? error.message : "Unable to load account" });
+        }
+        return true;
+    }
+    if (url.pathname === "/api/account/connect" && req.method === "POST") {
+        try {
+            const body = await readJson(req);
+            json(res, 200, await connectDashboardAccount(body.code));
+        }
+        catch (error) {
+            json(res, 400, { error: error instanceof Error ? error.message : "Prism sign-in failed" });
+        }
+        return true;
+    }
+    if (url.pathname === "/api/account/billing" && req.method === "POST") {
+        try {
+            json(res, 200, await openDashboardBilling());
+        }
+        catch (error) {
+            json(res, 502, { error: error instanceof Error ? error.message : "Billing unavailable" });
+        }
+        return true;
+    }
+    if (url.pathname === "/api/account/signout" && req.method === "POST") {
+        try {
+            const result = await signOutDashboardAccount();
+            json(res, result.revoked ? 200 : 502, {
+                ...result,
+                ...(result.revoked ? {} : { warning: "Signed out locally, but remote token revocation could not be confirmed" }),
+            });
+        }
+        catch (error) {
+            json(res, 500, { error: error instanceof Error ? error.message : "Sign-out failed" });
+        }
+        return true;
+    }
+    return false;
+}

package/dist/dashboard/graphRouter.js

@@ -77,6 +77,50 @@ export async function handleGraphRoutes(url, req, res, getStorageSafe) {
         if (min_importance)
             params.importance = `gte.${parseInt(min_importance, 10)}`;
         const graphLimit = !project && !days && !min_importance ? 30 : 200;
+        if (project && s.getDashboardMemoryGraph) {
+            const graph = await s.getDashboardMemoryGraph({
+                project,
+                ...(createdAfter ? { createdAfter } : {}),
+                ...(min_importance ? { minImportance: parseInt(min_importance, 10) } : {}),
+                limit: graphLimit,
+            });
+            const now = Date.now();
+            const nodes = graph.nodes.map((row) => {
+                const accessedAt = row.last_accessed_at || row.created_at;
+                const daysSince = accessedAt
+                    ? Math.max(0, Math.floor((now - new Date(accessedAt).getTime()) / (1000 * 60 * 60 * 24)))
+                    : 999;
+                const baseImportance = typeof row.importance === "number" ? row.importance : 0;
+                return {
+                    id: row.id,
+                    label: typeof row.summary === "string" && row.summary.trim() ? row.summary.trim() : String(row.id),
+                    group: "memory",
+                    days_since_access: daysSince,
+                    decayed_importance: baseImportance > 0
+                        ? Math.round(baseImportance * Math.pow(0.95, daysSince) * 100) / 100
+                        : 0,
+                    base_importance: baseImportance,
+                };
+            });
+            const nodeIds = new Set(nodes.map(node => node.id));
+            const edges = graph.edges
+                .filter((edge) => nodeIds.has(edge.source_id) && nodeIds.has(edge.target_id))
+                .map((edge) => ({
+                from: edge.source_id,
+                to: edge.target_id,
+                label: edge.link_type,
+                value: typeof edge.strength === "number" ? edge.strength : 1,
+            }));
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                graphType: "memory",
+                entryCount: nodes.length,
+                truncated: graph.truncated,
+                nodes,
+                edges,
+            }));
+            return true;
+        }
         const entries = s.getDashboardGraphEntries
             ? await s.getDashboardGraphEntries({
                 ...(project ? { project } : {}),

package/dist/dashboard/server.js

@@ -29,10 +29,11 @@ import { renderDashboardHTML } from "./ui.js";
 import { computeIntentHealth } from "./intentHealth.js";
 import { getAllSettings, setSetting, getSetting, getSettingSync } from "../storage/configStorage.js";
 import { compactLedgerHandler } from "../tools/compactionHandler.js";
-import { getLLMProvider } from "../utils/llm/factory.js";
+import { getEmbeddingProvider } from "../utils/llm/factory.js";
 import { buildVaultDirectory } from "../utils/vaultExporter.js";
 import { redactSettings } from "../tools/commonHelpers.js";
 import { handleGraphRoutes } from "./graphRouter.js";
+import { handleAccountRoutes } from "./accountRouter.js";
 import { isDashboardSettingKeyAllowed, isDashboardSettingValueAllowed } from "./settingsPolicy.js";
 import { isTrustedRequest, isRebindGuardedPath } from "./hostGuard.js";
 import { resolveDashboardToken, requestHasToken, buildTokenCookie, dashboardTokenCookieName, } from "./dashboardToken.js";
@@ -640,6 +641,11 @@ return false;}
                 res.writeHead(200, { "Content-Type": "application/json" });
                 return res.end(JSON.stringify({ ok: true, role, namespace: "user_skill" }));
             }
+            // ─── API: Synalux Account & Subscription ───
+            if (url.pathname.startsWith("/api/account")) {
+                if (await handleAccountRoutes(url, req, res))
+                    return;
+            }
             // ─── API: Knowledge Graph (v6.2 — extracted to graphRouter.ts) ───
             if (url.pathname.startsWith("/api/graph")) {
                 if (await handleGraphRoutes(url, req, res, getStorageSafe))
@@ -1007,7 +1013,7 @@ return false;}
                     // Check LLM provider availability before attempting embedding
                     let llm;
                     try {
-                        llm = getLLMProvider();
+                        llm = getEmbeddingProvider();
                     }
                     catch {
                         res.writeHead(503, { "Content-Type": "application/json" });