prism-mcp-server 20.7.0 → 20.8.0

package/README.md

@@ -56,6 +56,30 @@ Prism works locally without an account, API key, or cloud subscription. Add a
 Synalux subscription when you want cloud memory, paid-tier skills, or team
 features.
 
+### Install as a plugin
+
+Prism also ships as a plugin, which registers the MCP server and the startup
+skill for you.
+
+**Claude Code** — from the community marketplace:
+
+```bash
+/plugin marketplace add anthropics/claude-plugins-community
+/plugin install synalux-prism@claude-community
+```
+
+**Codex** — this repository is itself a plugin marketplace:
+
+```bash
+codex plugin marketplace add dcostenco/prism-coder
+codex plugin add synalux-prism@prism
+```
+
+The plugin registers `prism-mcp` via `npx -y prism-mcp-server`. If you already
+configured Prism by hand — `prism connect` writes an `mcp_servers.prism-mcp`
+entry — you have that server twice under one key. Install the plugin **or**
+run `prism connect`, not both.
+
 ### What `prism connect` changes about host subagents
 
 `connect` steers bounded work to `prism_infer` on your machine rather than to

package/dist/connect.js

@@ -1,4 +1,4 @@
-import { accessSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { accessSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32 as win32Path } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -1287,6 +1287,29 @@ function registerCodexTomlHost(definition, entry, dryRun, refresh, beforeCommit)
             return result(definition, "error", `could not parse config: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
+    // A Codex plugin may already register prism-mcp. Writing our own entry would
+    // configure the same server twice under one key, so every Prism tool appears
+    // in duplicate and load order decides which wins. Skip instead, and say why —
+    // an unexplained no-op is worse than the duplicate it prevents.
+    // Build the set of plugins Codex will actually load: present in [plugins]
+    // and not explicitly disabled. Detection must not fire on a stale cache
+    // entry for a plugin that is disabled or gone.
+    const enabledPluginKeys = new Set();
+    const pluginsTable = isJsonObject(config) ? config.plugins : undefined;
+    if (isJsonObject(pluginsTable)) {
+        for (const [key, entry] of Object.entries(pluginsTable)) {
+            if (isJsonObject(entry) && entry.enabled !== false)
+                enabledPluginKeys.add(key);
+        }
+    }
+    const providingPlugin = codexPluginProvidesPrismMcp(dirname(configPath), enabledPluginKeys);
+    if (providingPlugin && !locateCodexManagedBlock(originalText ?? "")) {
+        // "existing" rather than a new status: the server IS already registered,
+        // just by the plugin rather than by us. Nothing to do is the truth.
+        return result(definition, "existing", `the Codex plugin ${providingPlugin} already registers prism-mcp; ` +
+            "not adding a second registration under the same key. Remove the plugin " +
+            "if you would rather prism connect manage this server.");
+    }
     let managedBlock;
     try {
         managedBlock = locateCodexManagedBlock(originalText ?? "");
@@ -1377,6 +1400,71 @@ function serializeCodexManagedBlock(entry, existingText) {
     const serialized = stringifyToml({ mcp_servers: { "prism-mcp": entry } }).trimEnd();
     return `${CODEX_MANAGED_START}\n${serialized}\n${CODEX_MANAGED_END}\n`.replaceAll("\n", newline);
 }
+/**
+ * Is a Codex plugin already providing the prism-mcp server?
+ *
+ * Installing the plugin and running `prism connect` both register a server
+ * under the key `prism-mcp`, so doing both leaves the same server configured
+ * twice — every Prism tool appears in duplicate, and which one wins depends on
+ * load order. Previously this was only documented ("install the plugin OR run
+ * prism connect, not both"), which puts the burden on the user to remember.
+ *
+ * Detection reads the installed plugin's own manifest rather than matching a
+ * plugin NAME, so it keeps working if the plugin is renamed or vendored:
+ *   <codexHome>/plugins/cache/<marketplace>/<plugin>/<version>/.mcp.json
+ *
+ * A cache manifest is necessary but NOT sufficient: a disabled or half-removed
+ * plugin leaves its .mcp.json on disk (verified 2026-08-06 — flipping
+ * `enabled = false` in config.toml does not clear the cache). Counting file
+ * presence alone would make `prism connect` skip its own registration for a
+ * plugin that is not actually providing the server, leaving the user with no
+ * prism-mcp at all. So the plugin@marketplace key must ALSO be enabled in the
+ * caller's parsed config for it to count.
+ */
+export function codexPluginProvidesPrismMcp(codexHome, enabledPluginKeys) {
+    const cacheRoot = join(codexHome, "plugins", "cache");
+    let marketplaces;
+    try {
+        marketplaces = readdirSync(cacheRoot);
+    }
+    catch {
+        return null; // no plugins installed
+    }
+    for (const marketplace of marketplaces) {
+        let plugins;
+        try {
+            plugins = readdirSync(join(cacheRoot, marketplace));
+        }
+        catch {
+            continue;
+        }
+        for (const plugin of plugins) {
+            let versions;
+            try {
+                versions = readdirSync(join(cacheRoot, marketplace, plugin));
+            }
+            catch {
+                continue;
+            }
+            for (const version of versions) {
+                const manifest = join(cacheRoot, marketplace, plugin, version, ".mcp.json");
+                try {
+                    const parsed = JSON.parse(readFileSync(manifest, "utf8"));
+                    const key = `${plugin}@${marketplace}`;
+                    if (enabledPluginKeys.has(key) &&
+                        parsed?.mcpServers &&
+                        Object.prototype.hasOwnProperty.call(parsed.mcpServers, "prism-mcp")) {
+                        return key;
+                    }
+                }
+                catch {
+                    // absent or unreadable manifest — not a provider
+                }
+            }
+        }
+    }
+    return null;
+}
 function validateCodexCandidate(text) {
     const parsed = parseToml(text);
     if (!isJsonObject(parsed) || !isJsonObject(parsed.mcp_servers)) {

package/dist/storage/index.js

@@ -5,12 +5,60 @@ import { getSetting } from "./configStorage.js";
 export function isValidHttpUrl(url) {
     try {
         const parsed = new URL(url);
-        return parsed.protocol === "http:" || parsed.protocol === "https:";
+        if (parsed.protocol === "https:")
+            return true;
+        // Plain http is accepted ONLY for loopback, where the traffic never leaves
+        // the machine — the local Supabase stack runs on 127.0.0.1:54321.
+        //
+        // Every caller of this function is gating a CLOUD backend, so accepting
+        // http for a remote host meant session content — summaries, decisions,
+        // filenames — could be sent unencrypted. The privacy policy states this
+        // traffic travels over TLS; before this change that was true only because
+        // the default base URL happens to be https, not because anything enforced
+        // it. A published claim should be guaranteed by the code, not by a default
+        // the user can silently override.
+        if (parsed.protocol !== "http:")
+            return false;
+        const host = parsed.hostname;
+        return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
     }
     catch {
         return false;
     }
 }
+/**
+ * Upgrade a remote http:// cloud URL to https:// rather than rejecting it.
+ *
+ * Rejecting was the first fix for the plaintext gap, and it closed the hole
+ * but reported it badly: a user who set an http base URL got "credentials are
+ * missing or invalid", which says nothing about the protocol being the
+ * problem. Upgrading keeps the guarantee — session content never leaves over
+ * plaintext — while letting a working configuration keep working.
+ *
+ * Loopback is left alone: http on 127.0.0.1 never crosses a network, and the
+ * local Supabase stack serves plain http on 54321.
+ *
+ * The upgrade is announced, not silent. If the host genuinely has no TLS
+ * listener the connection fails afterwards, and the log line is what explains
+ * why.
+ */
+export function upgradeInsecureCloudUrl(raw) {
+    try {
+        const parsed = new URL(raw);
+        if (parsed.protocol !== "http:")
+            return raw;
+        const host = parsed.hostname;
+        if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]")
+            return raw;
+        parsed.protocol = "https:";
+        const upgraded = parsed.toString().replace(/\/+$/, "");
+        debugLog(`[Prism Storage] Upgraded ${raw} to ${upgraded}: session content is never sent over plaintext to a remote host.`);
+        return upgraded;
+    }
+    catch {
+        return raw;
+    }
+}
 /**
  * Probe for synalux credentials: env vars first, then config DB.
  * Returns true if usable credentials are now in process.env.
@@ -21,12 +69,14 @@ export async function ensureSynaluxCredentials() {
     // Re-check process.env directly: SYNALUX_CONFIGURED is captured at module
     // load, so credentials injected later by another caller would be invisible
     // to it. Mirrors ensureSupabaseCredentials below.
-    const envUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() || process.env.SYNALUX_BASE_URL?.trim();
+    const rawEnvUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() || process.env.SYNALUX_BASE_URL?.trim();
+    const envUrl = rawEnvUrl ? upgradeInsecureCloudUrl(rawEnvUrl) : rawEnvUrl;
     const envKey = process.env.PRISM_SYNALUX_API_KEY?.trim();
     if (envUrl && envKey && isValidHttpUrl(envUrl))
         return true;
-    const url = (await getSetting("PRISM_SYNALUX_BASE_URL"))?.trim() ||
+    const rawUrl = (await getSetting("PRISM_SYNALUX_BASE_URL"))?.trim() ||
         (await getSetting("SYNALUX_BASE_URL"))?.trim();
+    const url = rawUrl ? upgradeInsecureCloudUrl(rawUrl) : rawUrl;
     const key = (await getSetting("PRISM_SYNALUX_API_KEY"))?.trim();
     if (url && key && isValidHttpUrl(url)) {
         process.env.PRISM_SYNALUX_BASE_URL = url;
@@ -43,11 +93,13 @@ export async function ensureSynaluxCredentials() {
 async function ensureSupabaseCredentials() {
     if (SUPABASE_CONFIGURED)
         return true;
-    const envUrl = process.env.SUPABASE_URL?.trim();
+    const rawEnvUrl = process.env.SUPABASE_URL?.trim();
+    const envUrl = rawEnvUrl ? upgradeInsecureCloudUrl(rawEnvUrl) : rawEnvUrl;
     const envKey = process.env.SUPABASE_KEY?.trim();
     if (envUrl && envKey && isValidHttpUrl(envUrl))
         return true;
-    const url = (await getSetting("SUPABASE_URL"))?.trim();
+    const rawUrl = (await getSetting("SUPABASE_URL"))?.trim();
+    const url = rawUrl ? upgradeInsecureCloudUrl(rawUrl) : rawUrl;
     const key = (await getSetting("SUPABASE_KEY"))?.trim();
     if (url && key && isValidHttpUrl(url)) {
         process.env.SUPABASE_URL = url;
@@ -158,12 +210,36 @@ export async function getStorage() {
     return storageInstance;
 }
 export async function closeStorage() {
-    if (storageInstance) {
-        await storageInstance.close();
+    if (!storageInstance)
+        return;
+    const closing = storageInstance;
+    // Clear the slot in `finally`: if close() throws, the previous code left a
+    // DEAD instance installed as the singleton, and every later getStorage()
+    // handed that broken connection to callers. An empty slot is strictly
+    // safer — the next getStorage() re-opens cleanly. The error still
+    // propagates, so a caller like restoreFromBackup can abort before swapping
+    // the database file.
+    try {
+        await closing.close();
+    }
+    finally {
         storageInstance = null;
     }
 }
-/** Test-only: inject a pre-initialized storage instance into the singleton slot. */
+/**
+ * Test-only: inject a pre-initialized storage instance into the singleton slot.
+ *
+ * CONTRACT: the CALLER owns the lifecycle of what it injects. This function
+ * deliberately does NOT close the instance it replaces — callers pair the
+ * injection with their own cleanup (see createTestDb().cleanup), so closing
+ * here would double-close a storage the test still owns.
+ *
+ * Worth knowing when auditing handle leaks: an instance dropped without
+ * close() keeps its sqlite lock, and on Windows that lock blocks unlink of
+ * the database file until the process exits (libsql close() does not release
+ * it either — tursodatabase/libsql-js#228 — so closing is hygiene, not a
+ * guarantee).
+ */
 export function _setStorageForTesting(instance) {
     storageInstance = instance;
 }

package/dist/tools/ledgerHandlers.js

@@ -1689,6 +1689,64 @@ async function createLocalStartupStorage() {
     await storage.initialize(true);
     return storage;
 }
+/** Project name for the first-run demo memory. Its own project so it can never
+ * mix with real work, and trivially removable as a unit. */
+const DEMO_PROJECT = "prism-demo";
+/**
+ * First-run seed-and-show: write one demo ledger entry, then READ IT BACK
+ * through the storage layer and render from the read-back row.
+ *
+ * The read-back is the point. Rendering the local variable would prove
+ * nothing — a broken storage backend would still print a convincing
+ * "recalled" block. Rendering only what getLedgerEntries returned means the
+ * block the user sees IS evidence the save→recall loop works on their
+ * machine. If either half fails we return null and the greeting simply
+ * omits the demo — a first run must never break on a demo.
+ */
+export async function seedAndRecallDemoMemory(conversationId) {
+    try {
+        const storage = await getStorage();
+        // Idempotence before insert: the first_bootstrap_at marker is
+        // check-then-set, so two hosts bootstrapping a fresh machine at once BOTH
+        // take the first-run branch (observed setups run several agents
+        // concurrently). Seeding only when no demo row exists narrows that race
+        // from "every concurrent first run inserts" to a near-simultaneous
+        // read-read window, and the loser still renders the winner's row — the
+        // user sees one demo either way.
+        const existing = (await storage.getLedgerEntries({
+            project: `eq.${DEMO_PROJECT}`,
+            user_id: `eq.${PRISM_USER_ID}`,
+            limit: "1",
+        }));
+        if (existing.length === 0) {
+            await storage.saveLedger({
+                project: DEMO_PROJECT,
+                conversation_id: conversationId,
+                user_id: PRISM_USER_ID,
+                summary: "Prism saved this memory during your first session to demonstrate recall.",
+                todos: ["Try it yourself: ask your agent to `session_save_ledger` at the end of this session"],
+                decisions: ["Demo memory — delete anytime with session_forget_memory or from the dashboard"],
+                keywords: ["demo", "first-run"],
+            });
+        }
+        const rows = (await storage.getLedgerEntries({
+            project: `eq.${DEMO_PROJECT}`,
+            user_id: `eq.${PRISM_USER_ID}`,
+            order: "created_at.desc",
+            limit: "1",
+        }));
+        const recalled = rows[0];
+        if (!recalled?.summary)
+            return null;
+        const todo = Array.isArray(recalled.todos) && recalled.todos[0] ? `\n  - TODO it carried: ${recalled.todos[0]}` : "";
+        return (`- 🧠 **Watch this — Prism just saved a memory and recalled it from disk:**\n` +
+            `  - "${recalled.summary}"${todo}\n` +
+            `  - This round-trip is what every future session gets: your decisions, TODOs, and changed files, back the moment you return. (Demo lives in the \`${DEMO_PROJECT}\` project — delete it anytime.)`);
+    }
+    catch {
+        return null;
+    }
+}
 export async function sessionBootstrapHandler(args = {}, options = {}) {
     if (typeof args !== "object" || args === null || Array.isArray(args)) {
         throw new Error("Invalid arguments for session_bootstrap");
@@ -1759,7 +1817,17 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
         if (isFirstRun) {
             // Action-first instead of absence-first: every line is a capability or
             // a next step. The wizard exists and is well-built; route to it.
+            //
+            // Seed-and-show: a memory product's payoff is structurally deferred to
+            // session 2 — "it remembered" can't be felt until you come back. So the
+            // first run seeds one clearly-marked demo memory and shows it RECALLED,
+            // read back through the real storage layer (not string theater), so the
+            // save→recall loop is felt in session 1. The demo lives in its own
+            // project so it never mixes with real work, and this branch only runs
+            // once — the first_bootstrap_at marker above is durable.
+            const demoRecall = await seedAndRecallDemoMemory(conversationId);
             const firstRunText = `${greeting}\n\n` +
+                (demoRecall ? `${demoRecall}\n` : "") +
                 `- 🚀 **Get started:** run the \`onboarding_wizard\` tool (guided setup, ~3 minutes)\n` +
                 `${dashboardLine}\n` +
                 `- 💾 **Already working?** \`session_save_ledger\` records this session; the next one resumes with full context\n\n` +

package/dist/utils/backup.js

@@ -165,7 +165,24 @@ export async function restoreFromBackup(dbPath, backupPath) {
         // Create pre-restore backup
         const preRestoreResult = await createBackup(dbPath);
         debugLog(`Pre-restore backup: ${preRestoreResult.success ? "OK" : "FAILED"}`);
-        // Copy backup over current database
+        // Release the live connection BEFORE swapping the file underneath it.
+        //
+        // NOT a platform workaround. Measured on windows-x64 (2026-08-05):
+        // overwriting the database while a connection is open SUCCEEDS on
+        // every platform — SQLite shares the file for reading and writing,
+        // and only unlink/rename are blocked. So restore was never broken.
+        //
+        // The reason is correctness: replacing a database file beneath a live
+        // connection leaves that connection pointing at bytes it did not
+        // read, with a stale page cache and a WAL that no longer describes
+        // the file. SQLite documents this as unsafe. closeStorage() makes the
+        // swap atomic from the connection's point of view — the next
+        // getStorage() opens the restored file cleanly.
+        const { closeStorage } = await import("../storage/index.js");
+        await closeStorage();
+        // Copy backup over current database. closeStorage() cleared the
+        // singleton, so the next getStorage() re-opens against the restored
+        // file and no caller retains a handle to the replaced one.
         copyFileSync(backupPath, dbPath);
         return {
             success: true,

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.7.0",
+  "version": "20.8.0",
   "mcpName": "io.github.dcostenco/prism-coder",
-  "description": "Prism Coder \u2014 Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local or subscription-gated Synalux storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B\u201332B open-weights LLM fleet.",
+  "description": "Persistent session memory for AI coding agents that never leaves your machine \u2014 including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",
   "type": "module",
   "main": "dist/server.js",
@@ -35,68 +35,18 @@
     "import": "node dist/utils/universalImporter.js"
   },
   "keywords": [
-    "mcp",
     "mcp-server",
-    "model-context-protocol",
-    "ai-agent",
     "session-memory",
     "agent-memory",
-    "mind-palace",
     "local-first",
-    "sqlite",
-    "time-travel",
-    "visual-memory",
-    "multi-agent-sync",
-    "telepathy",
-    "morning-briefing",
-    "reality-drift",
-    "code-mode-templates",
-    "semantic-search",
-    "vector-search",
-    "pgvector",
-    "f32-blob",
-    "concurrency-control",
-    "mcp-prompts",
-    "mcp-resources",
-    "google-gemini",
-    "brave-search",
-    "llm",
-    "claude-desktop",
-    "supabase",
-    "progressive-context-loading",
-    "knowledge-accumulation",
-    "ai-memory",
-    "ai-tools",
-    "typescript",
-    "rag",
-    "embeddings",
-    "cursor",
+    "local-inference",
+    "drift-detection",
+    "knowledge-graph",
+    "claude-code",
     "codex",
-    "windsurf",
-    "cline",
-    "persistent-memory",
-    "zero-config",
-    "auto-capture",
-    "dashboard",
-    "actr",
-    "cognitive-memory",
-    "cognitive-architecture",
-    "activation-memory",
-    "spreading-activation",
-    "hebbian-learning",
-    "multi-hop-reasoning",
-    "rejection-gate",
-    "episodic-semantic",
-    "dark-factory",
-    "autonomous-pipeline",
-    "fail-closed",
-    "anti-sycophancy",
-    "local-embeddings",
-    "transformers-js",
-    "nomic-embed",
-    "business",
-    "enterprise",
-    "hipaa"
+    "cursor",
+    "offline",
+    "rag"
   ],
   "homepage": "https://github.com/dcostenco/prism-coder",
   "repository": {