prism-mcp-server 8.0.3 → 9.0.4

package/README.md

@@ -8,11 +8,11 @@
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.0+-3178C6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md)
 
-![Prism Mind Palace Dashboard](docs/mind-palace-dashboard.png)
+![Prism Mind Palace Dashboard — v9.0.4](docs/mind-palace-dashboard.png)
 
 **Your AI agent forgets everything between sessions. Prism fixes that — then teaches it to think.**
 
-Prism v8.0 is a true **Cognitive Architecture** inspired by human brain mechanics. The new **Synapse Engine** replaces flat vector search with pure multi-hop graph propagation — your agent now follows causal trains of thought across memory, forms principles from experience, and knows when it lacks information. **Your agents don't just remember; they think.**
+Prism v9.0 is the **Autonomous Cognitive OS** for AI agents. Built on a true cognitive architecture inspired by human brain mechanics, Prism gives agents affect-tagged memory, token-economic cost awareness, and multi-hop graph reasoning — your agent now follows causal trains of thought across memory, forms principles from experience, economizes what it stores, and knows when it lacks information. **Your agents don't just remember; they think.**
 
 ```bash
 npx -y prism-mcp-server
@@ -28,6 +28,7 @@ Works with **Claude Desktop · Claude Code · Cursor · Windsurf · Cline · Gem
 - [Setup Guides](#setup-guides)
 - [Universal Import: Bring Your History](#universal-import-bring-your-history)
 - [What Makes Prism Different](#what-makes-prism-different)
+- [Autonomous Cognitive OS (v9.0)](#-autonomous-cognitive-os-v90)
 - [Synapse Engine (v8.0)](#synapse-engine-v80)
 - [Cognitive Architecture (v7.8)](#cognitive-architecture-v78)
 - [Data Privacy & Egress](#data-privacy--egress)
@@ -39,6 +40,7 @@ Works with **Claude Desktop · Claude Code · Cursor · Windsurf · Cline · Gem
 - [Architecture](#architecture)
 - [Scientific Foundation](#scientific-foundation)
 - [Milestones & Roadmap](#milestones--roadmap)
+- [Enterprise & Commercial Support](#enterprise--commercial-support)
 - [Troubleshooting FAQ](#troubleshooting-faq)
 
 ---
@@ -415,6 +417,12 @@ npx -y prism-mcp-server universal-import --format gemini --path ./gemini_history
 ## What Makes Prism Different
 
 
+### 💰 Token-Economic Memory & Surprisal Gates (v9.0)
+Standard agents dump repetitive garbage into vector databases until they bankrupt your API budget and choke their own context windows. Prism introduces a **Persistent Cognitive Budget** with Universal Basic Income (UBI). Before saving, Prism calculates the semantic novelty (Surprisal) of the thought. Redundant boilerplate is penalized with a 2× cost multiplier; novel insights are rewarded. The agent is mathematically forced to learn compression.
+
+### 🎭 Affect-Tagged Emotional Routing (v9.0)
+Standard RAG retrieves documents based on similarity, not success rate. Prism tags experience events with **Valence** (-1.0 to +1.0). Highly emotional memories (catastrophic failures or massive successes) receive an affective salience boost during retrieval. If an agent heads down an architectural path that previously caused outages, Prism injects a preemptive `⚠️ Historical Friction` warning, giving your AI a "gut feeling" about bad code.
+
 ### 🧠 Your Agent Learns From Mistakes
 When you correct your agent, Prism tracks it. Corrections accumulate **importance** over time. High-importance lessons auto-surface as warnings in future sessions — and can even sync to your `.cursorrules` file for permanent enforcement. Your agent literally gets smarter the more you use it.
 
@@ -460,6 +468,41 @@ When you trigger a Dark Factory pipeline, Prism doesn't just run your task — i
 
 ---
 
+## 🤖 Autonomous Cognitive OS (v9.0)
+
+> *Memory isn't just about storing data; it's about economics and emotion. v9.0 transforms Prism from a passive memory database into a living Cognitive Operating System that forces agents to learn compression and develop intuition.*
+
+Most AI agents have an infinite memory budget. They dump massive, repetitive logs into vector databases until the context window chokes. Prism v9.0 fixes this by introducing **Token-Economic Reinforcement Learning** and **Affect-Tagged Memory**.
+
+### 1. Memory-as-an-Economy (The Surprisal Gate)
+Prism gives your project a strict **Cognitive Budget** (e.g., 2,000 tokens). Every time the agent saves a memory, it costs tokens. 
+
+But not all memories are priced equally:
+*   Prism intercepts the save and runs a **Vector-Based Surprisal** calculation against recent memories. 
+*   **High Surprisal (Novel thought):** Costs 0.5× tokens. The agent is rewarded for new insights.
+*   **Low Surprisal (Boilerplate):** Costs 2.0× tokens. The agent is penalized for repeating itself.
+*   **Universal Basic Income (UBI):** The budget recovers passively over time (+100 tokens/hour) or when the agent successfully completes autonomous evaluations. 
+
+**The Result:** You don't need to prompt the agent to "be concise." The physics of the system force the LLM to learn data compression to avoid bankruptcy.
+
+### 2. Affect-Tagged Memory (Giving AI a "Gut Feeling")
+Vector math measures *semantic similarity*, not *sentiment*. If an agent searches for "Authentication Architecture," standard RAG will return two past approaches—it doesn't know that Approach A caused a 3-day production outage, while Approach B worked perfectly.
+
+*   **Affective Salience:** Prism automatically tags experience events with a `valence` score (-1.0 for failure, +1.0 for success).
+*   **Emotional Retrieval:** At retrieval time, the absolute magnitude (`|valence|`) significantly boosts the memory's ranking score. Extreme failures and extreme successes surface to the top.
+*   **UX Warnings:** If the retrieved memories are historically negative, Prism intercepts the prompt injection: `⚠️ Caution: This topic is strongly correlated with historical failures. Review past decisions before proceeding.`
+
+### The Paradigm Shift
+
+| Feature | Standard RAG / Agents | Prism v9.0 |
+| :--- | :--- | :--- |
+| **Storage Limit** | Infinite (bloats context) | Bounded Token Economy |
+| **Data Quality** | Saves repetitive boilerplate | Surprisal Gate penalizes redundancy |
+| **Sentiment** | Treats all data as neutral facts | Affect-Tagged (Warns agent of past trauma) |
+| **Recovery** | Manual deletion | Universal Basic Income (UBI) over time |
+
+---
+
 ## Synapse Engine (v8.0)
 
 > *Standard RAG retrieves documents. GraphRAG traverses relationships. The Synapse Engine does both — a pure, storage-agnostic multi-hop propagation engine that turns your agent's memory into an associative reasoning network.*
@@ -739,8 +782,9 @@ The Generator strips the `console.log`, resubmits, and the next `EVALUATE` retur
 
 ## What's New
 
-> **Current release: v8.0.0 — Synapse Engine**
+> **Current release: v9.0.4 — Autonomous Cognitive OS**
 
+- 🧠 **v9.0.0 — Autonomous Cognitive OS:** Affect-Tagged Memory (valence engine — emotional salience boosts retrieval), Token-Economic Cognitive Budget (UBI + cost-per-save incentivizes novel memories), Surprisal Gate (vector-based novelty scoring). Full SQLite + Supabase parity with auto-migration 42. Hybrid scoring: `0.65 × similarity + 0.25 × activation + 0.10 × |valence|`. All features opt-out via env. **Post-review hardening:** 8 architectural fixes including delta-based concurrent budget writes, energy-weighted valence propagation, and anti-exploit budget decoupling. Graceful degradation: budget exhaustion warns but never blocks.
 - ⚡ **v8.0.0 — Synapse Engine:** Pure, storage-agnostic multi-hop graph propagation engine replaces the legacy SQL-coupled spreading activation. O(T × M) bounded ACT-R energy propagation with dampened fan effect, asymmetric bidirectional flow, cyclic loop prevention, and sigmoid normalization. Full integration into both SQLite and Supabase backends. 5 new config knobs. Battle-hardened with NaN guards, config clamping, non-fatal enrichment, and 16 passing tests. **Memory search now follows the causal graph, not just keywords.** → [Synapse Engine](#synapse-engine-v80)
 - 🧠 **v7.8.x — Cognitive Architecture:** Episodic-to-Semantic consolidation (Hebbian learning), ACT-R Spreading Activation with multi-hop causal reasoning, Uncertainty-Aware Rejection Gate, and Dynamic Fast Weight Decay. Validated by **LoCoMo-Plus benchmark**. → [Cognitive Architecture](#cognitive-architecture-v78)
 - 🌐 **v7.7.0 — Cloud-Native SSE Transport:** Full unauthenticated and authenticated Server-Sent Events MCP support for seamless network deployments.
@@ -1113,8 +1157,10 @@ Prism has evolved from smart session logging into a **cognitive memory architect
 | **v7.8** | Dynamic Fast Weight Decay — `is_rollup` semantic nodes decay 50% slower (`ageModifier = 0.5`) than episodic entries, creating Long-Term Context anchors | ACT-R base-level activation with differential decay rates | ✅ Shipped |
 | **v7.8** | LoCoMo Benchmark Harness — deterministic integration suite (`tests/benchmarks/locomo.ts`, 20 assertions) benchmarking multi-hop compaction structures via `MockLLM` | Long-Context Memory evaluation (cognitive benchmarking) | ✅ Shipped |
 | **v7.8** | LoCoMo-Plus Benchmark — 16-assertion suite (`tests/benchmarks/locomo-plus.ts`) adapted from arXiv 2602.10715 validating cue–trigger semantic disconnect bridging via graph traversal and Hebbian consolidation; reports Precision@1/3/5/10 and MRR | LoCoMo-Plus (Li et al., ARR 2026), cue–trigger disconnect research | ✅ Shipped |
-| **v7.x** | Affect-Tagged Memory — sentiment shapes what gets recalled | Affect-modulated retrieval (neuroscience) | 🔭 Horizon |
-| **v8+** | Zero-Search Retrieval — no index, no ANN, just ask the vector | Holographic Reduced Representations | 🔭 Horizon |
+| **v9.0** | Affect-Tagged Memory — valence-weighted retrieval; emotional salience boosts recall | Affect-modulated retrieval (neuroscience), Somatic marker hypothesis (Damasio) | ✅ Shipped |
+| **v9.0** | Token-Economic Cognitive Budget — UBI + cost-per-save token economy | Behavioral economics, bounded rationality (Simon) | ✅ Shipped |
+| **v9.0** | Surprisal Gate — novelty-based cost multiplier (high surprisal = cheap storage) | Bayesian surprise, predictive coding (Friston) | ✅ Shipped |
+| **v10+** | Zero-Search Retrieval — no index, no ANN, just ask the vector | Holographic Reduced Representations | 🔭 Horizon |
 
 > Informed by Anderson's ACT-R (Adaptive Control of Thought—Rational), Collins & Loftus spreading activation networks (1975), Kanerva's SDM (1988), Hebb's learning rule, Li et al. LoCoMo-Plus (ARR 2026), and LeCun's "Why AI Systems Don't Learn" (Dupoux, LeCun, Malik).
 
@@ -1122,10 +1168,11 @@ Prism has evolved from smart session logging into a **cognitive memory architect
 
 ## Milestones & Roadmap
 
-> **Current: v8.0.0** — Synapse Engine ([CHANGELOG](CHANGELOG.md))
+> **Current: v9.0.0** — Autonomous Cognitive OS ([CHANGELOG](CHANGELOG.md))
 
 | Release | Headline |
 |---------|----------|
+| **v9.0** | 🧠 Autonomous Cognitive OS — Affect-Tagged Memory (valence engine), Token-Economic Cognitive Budget, Surprisal Gate |
 | **v8.0** | ⚡ Synapse Engine — Pure multi-hop GraphRAG propagation, storage-agnostic, NaN-hardened, `[🌐 Synapse]` discovery tags |
 | **v7.8** | 🧠 Cognitive Architecture — Hebbian consolidation, multi-hop reasoning, rejection gate, dynamic decay |
 | **v7.7** | 🌐 Cloud-Native SSE Transport |
@@ -1139,8 +1186,9 @@ Prism has evolved from smart session logging into a **cognitive memory architect
 | **v6.2** | 🧩 Synthesize & Prune |
 
 ### Future Tracks
-- **v7.x: Affect-Tagged Memory** — Recall prioritization improves by weighting memories with affective/contextual valence.
-- **v8+: Zero-Search Retrieval** — Direct vector-addressed recall reduces retrieval indirection.
+- **v9.1: Predictive Push Memory** — Proactive context injection before the agent even asks — anticipating what it will need next.
+- **v9.4: Counterfactual Memory Branches** — "What if" reasoning over alternative decision paths.
+- **v10+: Zero-Search Retrieval** — Direct vector-addressed recall via Holographic Reduced Representations.
 
 👉 **[Full ROADMAP.md →](ROADMAP.md)**
 
@@ -1177,10 +1225,33 @@ A: Run `npm run build && npm test`, then open the Mind Palace dashboard (`localh
 
 ---
 
+## Enterprise & Commercial Support
+
+Prism is the **cognitive infrastructure layer** for production AI agent deployments. If your organization is building agent-powered products, we offer:
+
+### 🏢 Enterprise Integration
+- **Dedicated integration engineering** — Custom deployment into your existing agent stack (LangChain, LlamaIndex, CrewAI, AutoGen, custom MCP pipelines)
+- **On-premises deployment** — Air-gapped installations with full SQLite local mode, zero cloud dependency
+- **SSO & RBAC** — Enterprise authentication and role-based access control for multi-team Hivemind deployments
+- **SLA-backed support** — Priority issue resolution, architecture review, and upgrade planning
+
+### 🔬 Research & Institutional Partnerships
+- **Academic collaborations** — Prism's cognitive architecture is grounded in peer-reviewed research (ACT-R, Hebbian learning, SDM, HDC). We partner with research labs working on agent memory, cognitive modeling, and neurosymbolic AI.
+- **Grant-funded integrations** — We work with institutions applying for NSF, DARPA, or EU Horizon grants that require production-grade agent memory infrastructure.
+
+### 📬 Contact
+- **Enterprise inquiries:** [enterprise@prism-mcp.dev](mailto:enterprise@prism-mcp.dev)
+- **Partnership proposals:** [partnerships@prism-mcp.dev](mailto:partnerships@prism-mcp.dev)
+- **GitHub Issues:** [github.com/dcostenco/prism-mcp/issues](https://github.com/dcostenco/prism-mcp/issues) (community support)
+
+> 💡 **Open Source commitment:** Prism MCP remains MIT-licensed and free for individual developers, startups, and research teams. Enterprise services fund continued open-source development.
+
+---
+
 ## License
 
 MIT
 
 ---
 
-<sub>**Keywords:** MCP server, Model Context Protocol, Claude Desktop memory, persistent session memory, AI agent memory, cognitive architecture, ACT-R spreading activation, Hebbian learning, episodic semantic consolidation, multi-hop reasoning, uncertainty rejection gate, local-first, SQLite MCP, Mind Palace, time travel, visual memory, VLM image captioning, OpenTelemetry, GDPR, agent telepathy, multi-agent sync, behavioral memory, cursorrules, Ollama MCP, Brave Search MCP, TurboQuant, progressive context loading, knowledge management, LangChain retriever, LangGraph agent</sub>
+<sub>**Keywords:** MCP server, Model Context Protocol, Claude Desktop memory, persistent session memory, AI agent memory, cognitive architecture, ACT-R spreading activation, Hebbian learning, episodic semantic consolidation, multi-hop reasoning, uncertainty rejection gate, local-first, SQLite MCP, Mind Palace, time travel, visual memory, VLM image captioning, OpenTelemetry, GDPR, agent telepathy, multi-agent sync, behavioral memory, cursorrules, Ollama MCP, Brave Search MCP, TurboQuant, progressive context loading, knowledge management, LangChain retriever, LangGraph agent, enterprise AI agent infrastructure, autonomous cognitive OS, affect-tagged memory, valence engine, cognitive budget, surprisal gate</sub>

package/dist/config.js

@@ -78,7 +78,10 @@ export const VOYAGE_API_KEY = process.env.VOYAGE_API_KEY;
 //
 // Set PRISM_STORAGE=local to use SQLite (once implemented).
 // Set PRISM_STORAGE=supabase to use Supabase REST API (default).
-export const PRISM_STORAGE = process.env.PRISM_STORAGE || "supabase";
+// NOTE: This constant captures the env-var snapshot at import time.
+// The actual storage backend decision is made in storage/index.ts,
+// which consults prism-config.db first, then process.env, then defaults to "local".
+export const PRISM_STORAGE = process.env.PRISM_STORAGE || "local";
 // Logged at debug level — see debug() at bottom of file
 // ─── Optional: Supabase (Session Memory Module) ───────────────
 // When both SUPABASE_URL and SUPABASE_KEY are set, session memory tools
@@ -136,8 +139,22 @@ export const PRISM_DEBUG_LOGGING = process.env.PRISM_DEBUG_LOGGING === "true";
 // The role parameter on existing tools (session_save_ledger, etc.)
 // is always available regardless of this flag — adding a parameter
 // doesn't increase tool count.
-// Set PRISM_ENABLE_HIVEMIND=true to unlock the Agent Registry tools.
-export const PRISM_ENABLE_HIVEMIND = process.env.PRISM_ENABLE_HIVEMIND === "true";
+//
+// SOURCE OF TRUTH: The Mind Palace dashboard (Settings → Hivemind Mode)
+// persists this flag to prism-config.db via getSettingSync() at call time.
+//
+// ⚠️ IMPORTANT: This _ENV constant captures ONLY the env-var fallback.
+// config.ts is evaluated at ESM import time, BEFORE initConfigStorage()
+// populates the settings cache. Use getSettingSync("hivemind_enabled",
+// String(PRISM_ENABLE_HIVEMIND_ENV)) at each call site for the live value.
+export const PRISM_ENABLE_HIVEMIND_ENV = process.env.PRISM_ENABLE_HIVEMIND === "true";
+// ─── v3.0: Task Router Feature Flag ──────────────────────────
+// Routes tasks to the local Claw agent when enabled.
+// SOURCE OF TRUTH: dashboard (Settings → Task Router) → prism-config.db.
+// Same _ENV pattern: use getSettingSync() at call sites.
+// REMOVED: PRISM_TASK_ROUTER_ENABLED used to call getSettingSync() at import time,
+// which always returned the fallback due to the ESM race condition (settingsCache=null).
+// Use PRISM_TASK_ROUTER_ENABLED_ENV (line ~368) and getSettingSync() at call sites instead.
 // ─── v4.1: Auto-Load Projects ────────────────────────────────
 // Auto-load is configured exclusively via the Mind Palace dashboard
 // ("Auto-Load Projects" checkboxes in Settings). The setting is stored
@@ -262,8 +279,10 @@ export const PRISM_VERIFICATION_DEFAULT_SEVERITY = (process.env.PRISM_VERIFICATI
 // ─── v7.3: Dark Factory Orchestration ─────────────────────────
 // Autonomous pipeline runner: PLAN → EXECUTE → VERIFY → iterate.
 // Opt-in because it executes LLM calls in the background.
-/** Master switch for the Dark Factory background runner. */
-export const PRISM_DARK_FACTORY_ENABLED = process.env.PRISM_DARK_FACTORY_ENABLED === "true"; // Opt-in
+/** Master switch for the Dark Factory background runner.
+ *  ⚠️ ENV-only fallback. Use getSettingSync("dark_factory_enabled",
+ *  String(PRISM_DARK_FACTORY_ENABLED_ENV)) at call sites. */
+export const PRISM_DARK_FACTORY_ENABLED_ENV = process.env.PRISM_DARK_FACTORY_ENABLED === "true"; // Opt-in
 /** Poll interval for the runner loop (ms). Default: 30s. */
 export const PRISM_DARK_FACTORY_POLL_MS = parseInt(process.env.PRISM_DARK_FACTORY_POLL_MS || "30000", 10);
 /** Default max wall-clock time per pipeline (ms). Default: 15 minutes. */
@@ -282,3 +301,21 @@ export const PRISM_SYNAPSE_SPREAD_FACTOR = parseFloat(process.env.PRISM_SYNAPSE_
 export const PRISM_SYNAPSE_LATERAL_INHIBITION = parseInt(process.env.PRISM_SYNAPSE_LATERAL_INHIBITION || "7", 10);
 /** Soft cap on active nodes per iteration (prevents explosion). (Default: 20) */
 export const PRISM_SYNAPSE_SOFT_CAP = parseInt(process.env.PRISM_SYNAPSE_SOFT_CAP || "20", 10);
+// ─── v9.0: Affect-Tagged Memory (Valence Engine) ─────────────
+// Derives emotional valence from experience events and uses
+// Affective Salience (|valence| boosts retrieval) for ranking.
+/** Master switch for affect-tagged memory. (Default: true) */
+export const PRISM_VALENCE_ENABLED = (process.env.PRISM_VALENCE_ENABLED ?? "true") !== "false";
+/** Weight of |valence| in hybrid scoring formula. (Default: 0.1) */
+export const PRISM_VALENCE_WEIGHT = parseFloat(process.env.PRISM_VALENCE_WEIGHT || "0.1");
+/** Average valence below this threshold triggers a UX warning. (Default: -0.3) */
+export const PRISM_VALENCE_WARNING_THRESHOLD = parseFloat(process.env.PRISM_VALENCE_WARNING_THRESHOLD || "-0.3");
+// ─── v9.0: Token-Economic RL (Cognitive Budget) ──────────────
+// Implements a strict token economy for agent memory operations.
+// Budget is persistent (stored in session_handoffs.cognitive_budget).
+/** Master switch for the cognitive budget system. (Default: true) */
+export const PRISM_COGNITIVE_BUDGET_ENABLED = (process.env.PRISM_COGNITIVE_BUDGET_ENABLED ?? "true") !== "false";
+/** Initial budget size per project in tokens. (Default: 2000) */
+export const PRISM_COGNITIVE_BUDGET_SIZE = parseInt(process.env.PRISM_COGNITIVE_BUDGET_SIZE || "2000", 10);
+/** Master switch for the surprisal gate. (Default: true) */
+export const PRISM_SURPRISAL_GATE_ENABLED = (process.env.PRISM_SURPRISAL_GATE_ENABLED ?? "true") !== "false";

package/dist/dashboard/server.js

@@ -20,6 +20,9 @@ import * as http from "http";
 import * as path from "path";
 import * as os from "os";
 import * as fs from "fs";
+import * as pg from "pg";
+import { fileURLToPath } from "url";
+import { dirname, resolve } from "path";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { createServer, getAllPossibleTools } from "../server.js";
 import { getStorage } from "../storage/index.js";
@@ -34,6 +37,13 @@ import { redactSettings } from "../tools/commonHelpers.js";
 import { handleGraphRoutes } from "./graphRouter.js";
 import { safeCompare, generateToken, isAuthenticated, createRateLimiter, } from "./authUtils.js";
 const PORT = parseInt(process.env.PRISM_DASHBOARD_PORT || "3000", 10);
+/**
+ * v9.2: SSE stream registry for migration progress.
+ * Key = progressKey (timestamp string from the client).
+ * Value = the ServerResponse that is kept open as an SSE stream.
+ * Entries are deleted when the stream ends or the client disconnects.
+ */
+const migrationProgressStreams = new Map();
 /** Read HTTP request body as string (Buffer-based to avoid GC thrash on large imports) */
 function readBody(req) {
     return new Promise((resolve, reject) => {
@@ -575,6 +585,11 @@ return false;}
                 try {
                     const { getAllSettings } = await import("../storage/configStorage.js");
                     const settings = await getAllSettings();
+                    // Since v3.0, the DB is the exclusive source of truth for dashboard UI state.
+                    // Values from process.env are seeded into the DB on first startup via
+                    // migrateEnvToConfigStorage(), but we no longer override DB settings here.
+                    // This ensures that dashboard changes safely persist across restarts even
+                    // if legacy .env values remain.
                     res.writeHead(200, { "Content-Type": "application/json" });
                     return res.end(JSON.stringify({ settings }));
                 }
@@ -602,6 +617,109 @@ return false;}
                     return res.end(JSON.stringify({ error: "Invalid JSON body" }));
                 }
             }
+            // ─── API: Migration Progress SSE Stream (v9.2) ───────────
+            // Client subscribes with GET /api/migration/progress?key=<progressKey>
+            // Server pushes { step, total, label, pct?, done?, error? } events.
+            // The stream is closed server-side once setup-supabase completes.
+            if (url.pathname === "/api/migration/progress" && req.method === "GET") {
+                const key = url.searchParams.get("key") || "";
+                res.writeHead(200, {
+                    "Content-Type": "text/event-stream",
+                    "Cache-Control": "no-cache",
+                    "Connection": "keep-alive",
+                    "X-Accel-Buffering": "no",
+                });
+                res.write("retry: 1000\n\n"); // 1s reconnect delay
+                // Register the response so setup-supabase can push events
+                migrationProgressStreams.set(key, res);
+                req.on("close", () => {
+                    migrationProgressStreams.delete(key);
+                });
+                return; // keep connection open — do NOT call res.end() here
+            }
+            // ─── API: Supabase Initial Setup (v9.1) ─────────────────
+            if (url.pathname === "/api/setup-supabase" && req.method === "POST") {
+                // Hoist progressKey so the catch block can reference it for SSE error reporting
+                let progressKey;
+                try {
+                    const body = await readBody(req);
+                    const parsed = JSON.parse(body);
+                    const { url: supaUrl, serviceKey, dbPassword } = parsed;
+                    progressKey = parsed.progressKey;
+                    if (!supaUrl || !serviceKey || !dbPassword) {
+                        res.writeHead(400, { "Content-Type": "application/json" });
+                        return res.end(JSON.stringify({ error: "Missing url, serviceKey, or dbPassword" }));
+                    }
+                    // Helper: push SSE progress event to the subscribed client
+                    function emitProgress(step, total, label, extra = {}) {
+                        const stream = migrationProgressStreams.get(progressKey || "");
+                        if (!stream)
+                            return;
+                        const pct = Math.round((step / total) * 100);
+                        const payload = JSON.stringify({ step, total, label, pct, ...extra });
+                        stream.write(`data: ${payload}\n\n`);
+                    }
+                    const TOTAL_STEPS = 6;
+                    emitProgress(1, TOTAL_STEPS, "Connecting to Supabase database…");
+                    // 1. Build DB connection string
+                    const parsedUrl = new URL(supaUrl);
+                    const host = parsedUrl.host; // e.g. pjddaprqhwqxtcpdmprk.supabase.co
+                    const projectRef = host.split(".")[0];
+                    const dbHost = `db.${projectRef}.supabase.co`;
+                    const connectionString = `postgresql://postgres:${encodeURIComponent(dbPassword)}@${dbHost}:5432/postgres`;
+                    emitProgress(2, TOTAL_STEPS, "Authenticating…");
+                    // 2. Connect via pg
+                    const client = new pg.Client({ connectionString });
+                    await client.connect();
+                    try {
+                        emitProgress(3, TOTAL_STEPS, "Applying migration schema (027)…");
+                        // 3. Inject auto-migration infrastructure
+                        const currentDir = dirname(fileURLToPath(import.meta.url));
+                        const sqlPath = resolve(currentDir, "../../supabase/migrations/027_auto_migration_infra.sql");
+                        const sql = fs.readFileSync(sqlPath, "utf-8");
+                        await client.query(sql);
+                        emitProgress(4, TOTAL_STEPS, "Applying v9.0 schema columns…");
+                        // 4. Also safely inject v9.0 columns just in case the backend tries to write them right away
+                        await client.query(`
+              ALTER TABLE session_ledger ADD COLUMN IF NOT EXISTS valence REAL DEFAULT NULL;
+              CREATE INDEX IF NOT EXISTS idx_ledger_valence ON session_ledger(valence) WHERE valence IS NOT NULL;
+              ALTER TABLE session_handoffs ADD COLUMN IF NOT EXISTS cognitive_budget REAL DEFAULT NULL;
+            `);
+                    }
+                    finally {
+                        await client.end();
+                    }
+                    emitProgress(5, TOTAL_STEPS, "Persisting credentials…");
+                    // 5. Persist values using configStorage
+                    const { setSetting } = await import("../storage/configStorage.js");
+                    await setSetting("PRISM_STORAGE", "supabase");
+                    await setSetting("SUPABASE_URL", supaUrl);
+                    await setSetting("SUPABASE_KEY", serviceKey);
+                    await setSetting("SUPABASE_SERVICE_ROLE_KEY", serviceKey);
+                    emitProgress(6, TOTAL_STEPS, "Complete!", { done: true });
+                    // Close the SSE stream
+                    const sseStream = migrationProgressStreams.get(progressKey || "");
+                    if (sseStream) {
+                        sseStream.end();
+                        migrationProgressStreams.delete(progressKey || "");
+                    }
+                    // 6. Return success
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    return res.end(JSON.stringify({ ok: true, message: "Supabase successfully configured! Please restart Prism." }));
+                }
+                catch (err) {
+                    console.error("[Dashboard] Supabase Setup error:", err);
+                    // Emit error event to the progress stream (progressKey is captured from the outer scope)
+                    const errStream = migrationProgressStreams.get(progressKey || "");
+                    if (errStream) {
+                        errStream.write(`data: ${JSON.stringify({ error: true, label: err.message || "Setup failed", done: false })}\n\n`);
+                        errStream.end();
+                        migrationProgressStreams.delete(progressKey || "");
+                    }
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    return res.end(JSON.stringify({ error: err.message || "Failed to setup Supabase" }));
+                }
+            }
             // ─── API: Memory Analytics (v3.1) ────────────────────
             if (url.pathname === "/api/analytics" && req.method === "GET") {
                 const projectName = url.searchParams.get("project");