prism-mcp-server 9.0.6 → 9.1.1

package/README.md

@@ -20,6 +20,8 @@ npx -y prism-mcp-server
 
 Works with **Claude Desktop · Claude Code · Cursor · Windsurf · Cline · Gemini · Antigravity** — **any MCP client.**
 
+https://github.com/dcostenco/prism-mcp/raw/main/docs/prism_mcp_demo.mp4
+
 ## 📖 Table of Contents
 
 - [Why Prism?](#why-prism)
@@ -437,13 +439,13 @@ A gorgeous glassmorphism UI at `localhost:3000` that lets you see exactly what y
 
 
 ### 🧬 10× Memory Compression
-Powered by a pure TypeScript port of Google's TurboQuant (inspired by Google's ICLR research), Prism compresses 768-dim embeddings from **3,072 bytes → ~400 bytes** — enabling decades of session history on a standard laptop. No native modules. No vector database required.
+Powered by a pure TypeScript port of Google's TurboQuant (inspired by Google's ICLR research), Prism compresses 768-dim embeddings from **3,072 bytes → ~400 bytes** — enabling decades of session history on a standard laptop. No native modules. No vector database required. To mitigate quantization degradation (where repeated compress/decompress cycles could smear subtle corrections after 10k+ memories), Prism leverages autonomous **ledger compaction** and **Deep Storage cleanup** to guarantee high-fidelity memory integrity over time.
 
-### 🐝 Multi-Agent Hivemind
-Multiple agents (dev, QA, PM) can work on the same project with **role-isolated memory**. Agents discover each other automatically, share context in real-time via Telepathy sync, and see a team roster during context loading. → [Multi-agent setup example](examples/multi-agent-hivemind/)
+### 🐝 Multi-Agent Hivemind & Enterprise Sync
+While local SQLite is amazing for solo developers, enterprise teams cannot share a local SQLite file. Prism breaks the "local-only" ceiling via **Supabase Sync** and the **Multi-Agent Hivemind**—scaling effortlessly to teams of 50+ developers using agents. Multiple agents (dev, QA, PM) can work on the same project with **role-isolated memory**, discover each other automatically, and share context in real-time via Telepathy sync to a shared Postgres backend. → [Multi-agent setup example](examples/multi-agent-hivemind/)
 
 ### 🚦 Task Router
-Prism can score coding tasks and recommend whether to keep execution on the host model or delegate to a **local Claw agent** (a lightweight sub-agent powered by Ollama/vLLM for fast, local-safe edits). This enables faster handling of small edits while preserving host execution for complex work. In client startup/skill flows, use defensive delegation: route only coding tasks, call `session_task_route` only when available, delegate to `claw` only when executor tooling exists and task is non-destructive, and fallback to host when router/executor is unavailable. → [Task router real-life example](examples/router_real_life_test.ts)
+Prism scores coding tasks across **6 weighted heuristic signals** (keyword analysis, file count, file-type complexity, scope, length, multi-step detection) and recommends whether to keep execution on the host cloud model or delegate to a **local Claw agent** (powered by deepseek-r1 / qwen2.5-coder via Ollama). File-type awareness routes config/docs edits locally while reserving systems-programming tasks for the host. The local agent features buffered streaming (handles split `<think>` tags), stateful multi-turn conversations, and automatic memory trimming. In client startup/skill flows, use defensive delegation: route only coding tasks, call `session_task_route` only when available, delegate to `claw` only when executor tooling exists and task is non-destructive, and fallback to host when router/executor is unavailable. → [Task router real-life example](examples/router_real_life_test.ts)
 
 ### 🖼️ Visual Memory
 Save UI screenshots, architecture diagrams, and bug states to a searchable vault. Images are auto-captioned by a VLM (Claude Vision / GPT-4V / Gemini) and become semantically searchable across sessions.
@@ -725,13 +727,13 @@ The Generator strips the `console.log`, resubmits, and the next `EVALUATE` retur
 
 ## 🆕 What's New
 
-> **Current release: v9.0.5 — JWKS Auth Security Hardening**
+> **Current release: v9.1.0 — Task Router v2 & Local Agent Hardening**
 
-- 🔒 **v9.0.5 — JWKS Auth Security Hardening:** JWT audience/issuer claim validation (`PRISM_JWT_AUDIENCE`, `PRISM_JWT_ISSUER`), structured error logging for JWT failures, typed `PrismAuthenticatedRequest` interface, 11 new JWKS unit tests, Smithery server card fix. Vendor-neutral — tested with Auth0, AgentLair, Keycloak, and custom JWKS endpoints.
+- 🚦 **v9.1.0 — Task Router v2:** File-type complexity signal for intelligent code-vs-config routing, 6-signal weighted heuristic engine, multi-step false-positive fix, expanded file extension classification. Local agent hardened with buffered streaming, system prompts, memory trimming, and stateful `/api/chat` API.
+- 🔒 **v9.0.5 — JWKS Auth Security Hardening:** JWT audience/issuer claim validation (`PRISM_JWT_AUDIENCE`, `PRISM_JWT_ISSUER`), structured error logging for JWT failures, typed `PrismAuthenticatedRequest` interface, 11 new JWKS unit tests, Smithery server card fix. Vendor-neutral — tested with Auth0, AgentLair ([llms.txt](https://agentlair.com/llms.txt)), Keycloak, and custom JWKS endpoints.
 - 🧠 **v9.0.0 — Autonomous Cognitive OS:** Token-Economic Reinforcement Learning (Surprisal Gate + Cognitive Budget), Affect-Tagged Memory (valence-scored retrieval), and Episodic→Semantic Consolidation. Your agents learn compression and develop intuition. → [Cognitive OS](#-autonomous-cognitive-os-v90)
 - 🧠 **v7.8.0 — Cognitive Architecture:** Episodic-to-Semantic memory consolidation (Hebbian learning), ACT-R Spreading Activation with multi-hop causal reasoning, Uncertainty-Aware Rejection Gate, and Dynamic Fast Weight Decay. → [Cognitive Architecture](#-cognitive-architecture-v78)
 - 🌐 **v7.7.0 — Cloud-Native SSE Transport:** Full Server-Sent Events MCP support for seamless network deployments.
-- ⚔️ **v7.4.0 — Adversarial Evaluation:** Split-brain anti-sycophancy pipeline with evidence-bound findings.
 
 👉 **[Full release history → CHANGELOG.md](CHANGELOG.md)** · **[ROADMAP →](ROADMAP.md)**
 
@@ -1100,12 +1102,37 @@ Prism has evolved from smart session logging into a **cognitive memory architect
 
 ---
 
+## 💼 B2B Consulting & Enterprise Support
+
+Prism MCP is open-source and free for individual developers. For teams and enterprises building autonomous AI workflows or integrating MCP-native memory at scale, we offer professional consulting and setup packages.
+
+### 🥉 Team Pilot Package
+*Perfect for engineering teams adopting MCP tools and collaborative agents.*
+* **What's included:** Full team rollout, managed Supabase configuration (for multi-device sync), Universal Import of legacy chat history, and dedicated setup support.
+* **Model:** Fixed-price engagement.
+
+### 🥈 Cognitive Architecture Tuning
+*For teams building advanced AI agents or autonomous pipelines.*
+* **What's included:** "Dark Factory" pipeline implementation tailored to your workflows, adversarial evaluator tuning, custom HDC cognitive route configuration, and local open-weight model integration (BYOM).
+* **Model:** Retainer or project-based.
+
+### 🥇 Enterprise Integration
+*Full-scale deployment for high-compliance environments.*
+* **What's included:** Active Directory / custom JWKS auth integration, Air-gapped on-premise deployment, custom OTel Grafana dashboards for cognitive observability, and custom skills/tools development.
+* **Model:** Custom enterprise quote.
+
+**Interested in accelerating your team's autonomous workflows?**  
+[📧 Contact us for a consultation](mailto:inquiries@prism-mcp.com) — let's build your organization's cognitive memory engine.
+
+---
+
 ## 📦 Milestones & Roadmap
 
-> **Current: v9.0.5** — JWKS Auth Security Hardening ([CHANGELOG](CHANGELOG.md))
+> **Current: v9.1.0** — Task Router v2 & Local Agent Hardening ([CHANGELOG](CHANGELOG.md))
 
 | Release | Headline |
 |---------|----------|
+| **v9.1.0** | 🚦 Task Router v2 — file-type routing signal, 6-signal heuristics, local agent streaming buffer |
 | **v9.0.5** | 🔒 JWKS Auth Security Hardening — audience/issuer validation, JWT failure logging, typed agent identity |
 | **v9.0** | 🧠 Autonomous Cognitive OS — Surprisal Gate, Cognitive Budget, Affect-Tagged Memory |
 | **v7.8** | 🧠 Cognitive Architecture — Hebbian consolidation, multi-hop reasoning, rejection gate, dynamic decay |

package/dist/config.js

@@ -46,21 +46,21 @@ export const SERVER_CONFIG = {
 };
 // ─── Required: Brave Search API Key ───────────────────────────
 export const BRAVE_API_KEY = process.env.BRAVE_API_KEY;
-if (!BRAVE_API_KEY) {
+if (!BRAVE_API_KEY && process.env.PRISM_DEBUG_LOGGING === "true") {
     console.error("Warning: BRAVE_API_KEY environment variable is missing. Search tools will return errors when called.");
 }
 // ─── Optional: Google Gemini API Key ──────────────────────────
 // Used by the gemini_research_paper_analysis tool.
 // Without this, the tool will still appear but will error when called.
 export const GOOGLE_API_KEY = process.env.GOOGLE_API_KEY;
-if (!GOOGLE_API_KEY) {
+if (!GOOGLE_API_KEY && process.env.PRISM_DEBUG_LOGGING === "true") {
     console.error("Warning: GOOGLE_API_KEY environment variable is missing. Gemini research features will be unavailable.");
 }
 // ─── Optional: Brave Answers API Key ──────────────────────────
 // Used by the brave_answers tool for AI-grounded answers.
 // This is a separate API key from the main Brave Search key.
 export const BRAVE_ANSWERS_API_KEY = process.env.BRAVE_ANSWERS_API_KEY;
-if (!BRAVE_ANSWERS_API_KEY) {
+if (!BRAVE_ANSWERS_API_KEY && process.env.PRISM_DEBUG_LOGGING === "true") {
     console.error("Warning: BRAVE_ANSWERS_API_KEY environment variable is missing. Brave Answers tool will be unavailable.");
 }
 // ─── Optional: Voyage AI API Key ──────────────────────────────

package/dist/storage/index.js

@@ -16,9 +16,31 @@ export async function getStorage() {
     // Use environment variable if explicitly set, otherwise fall back to db config
     const envStorage = process.env.PRISM_STORAGE;
     const requestedBackend = (envStorage || await getSetting("PRISM_STORAGE", ENV_PRISM_STORAGE));
-    // Guardrail: if Supabase is requested but credentials are unresolved/invalid,
-    // transparently fall back to local mode to keep dashboard + core tools usable.
-    if (requestedBackend === "supabase" && !SUPABASE_CONFIGURED) {
+    // Guardrail: if Supabase is requested but env-var credentials are missing,
+    // check the dashboard config DB (prism-config.db) as a fallback before
+    // giving up. Dashboard settings take precedence over absent env vars.
+    let supabaseReady = SUPABASE_CONFIGURED;
+    if (!supabaseReady && requestedBackend === "supabase") {
+        const dashUrl = await getSetting("SUPABASE_URL");
+        const dashKey = await getSetting("SUPABASE_KEY");
+        if (dashUrl && dashKey) {
+            try {
+                const parsed = new URL(dashUrl);
+                if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+                    supabaseReady = true;
+                    // Inject into process.env so downstream consumers (SupabaseStorage,
+                    // SyncBus) pick them up without needing their own dashboard lookups.
+                    process.env.SUPABASE_URL = dashUrl;
+                    process.env.SUPABASE_KEY = dashKey;
+                    debugLog("[Prism Storage] Using Supabase credentials from dashboard config");
+                }
+            }
+            catch {
+                // Invalid URL — fall through to local fallback
+            }
+        }
+    }
+    if (requestedBackend === "supabase" && !supabaseReady) {
         activeStorageBackend = "local";
         console.error("[Prism Storage] Supabase backend requested but SUPABASE_URL/SUPABASE_KEY are invalid or unresolved. Falling back to local storage.");
     }

package/dist/sync/factory.js

@@ -1,13 +1,6 @@
-/**
- * SyncBus Factory — Routes to the correct sync implementation (v2.0 — Step 6)
- *
- * Returns SqliteSyncBus for local mode, SupabaseSyncBus for cloud mode.
- * Uses the same PRISM_STORAGE env var as the storage factory.
- *
- * Singleton pattern — only one bus per process (prevents duplicate watchers).
- */
 import { PRISM_STORAGE } from "../config.js";
 import { debugLog } from "../utils/logger.js";
+import { getSetting } from "../storage/configStorage.js";
 let _bus = null;
 export async function getSyncBus() {
     if (_bus)
@@ -18,10 +11,11 @@ export async function getSyncBus() {
     }
     else {
         const { SupabaseSyncBus } = await import("./supabaseSync.js");
-        const url = process.env.SUPABASE_URL;
-        const key = process.env.SUPABASE_KEY || process.env.SUPABASE_ANON_KEY;
+        // Check env vars first, then fall back to dashboard config (prism-config.db)
+        const url = process.env.SUPABASE_URL || await getSetting("SUPABASE_URL");
+        const key = process.env.SUPABASE_KEY || process.env.SUPABASE_ANON_KEY || await getSetting("SUPABASE_KEY");
         if (!url || !key) {
-            console.error("[SyncBus] Supabase credentials not found — falling back to local sync bus");
+            debugLog("[SyncBus] Supabase credentials not found in env or dashboard — falling back to local sync bus");
             const { SqliteSyncBus } = await import("./sqliteSync.js");
             _bus = new SqliteSyncBus();
         }

package/dist/tools/taskRouterHandler.js

@@ -1,20 +1,20 @@
 /**
- * Task Router Handler (v7.1.0)
+ * Task Router Handler (v9.1.0)
  *
  * Pure, deterministic heuristic-based routing engine that analyzes a coding
  * task description and recommends whether it should be handled by the host
- * cloud model or delegated to the local claw-code-agent (Qwen3).
+ * cloud model or delegated to the local claw-code-agent (deepseek-r1 / qwen2.5-coder).
  *
- * No database queries. No API calls. Fully testable.
+ * No database queries in the pure route. No API calls. Fully testable.
+ * Experience-based ML bias (v7.2.0+) is applied post-hoc in the handler.
  *
- * Heuristic Signals (v7.1.0):
+ * Heuristic Signals:
  *   1. Keyword analysis        (weight: 0.35)
- *   2. File count               (weight: 0.20)
- *   3. estimated_scope enum     (weight: 0.25)
- *   4. Task length proxy        (weight: 0.10)
- *   5. Multi-step detection     (weight: 0.10)
- *
- * v7.2.0 will add experience-based ML routing using SQLite feedback data.
+ *   2. File count               (weight: 0.15)
+ *   3. File type / extension    (weight: 0.10)
+ *   4. estimated_scope enum     (weight: 0.20)
+ *   5. Task length proxy        (weight: 0.10)
+ *   6. Multi-step detection     (weight: 0.10)
  */
 import { isSessionTaskRouteArgs, } from "./sessionMemoryDefinitions.js";
 import { getStorage } from "../storage/index.js";
@@ -59,7 +59,8 @@ const MULTI_STEP_MARKERS = [
     "step 1", "step 2", "step 3",
     "then update", "then modify", "then create",
     "followed by", "subsequently",
-    "1.", "2.", "3.",
+    // Note: removed bare "1.", "2.", "3." — too many false positives
+    // on version numbers (v1.2.3), decimals, and IP addresses.
 ];
 // ─── Heuristic Engine ────────────────────────────────────────
 /**
@@ -108,7 +109,32 @@ function fileCountSignal(files) {
     return -1.0;
 }
 /**
- * Compute a claw-affinity score from estimated_scope.
+ * Compute a claw-affinity score from file extentions.
+ * Simple configs/docs -> claw (+0.5)
+ * Complex low-level languages -> host (-0.5)
+ */
+function fileTypeSignal(files) {
+    if (!files || files.length === 0)
+        return 0;
+    let simple = 0;
+    let complex = 0;
+    for (const f of files) {
+        if (f.match(/\.(md|json|yml|yaml|txt|csv|env|ini|toml|cfg)$/i))
+            simple++;
+        else if (f.match(/\.(cpp|cc|cxx|c|h|hpp|rs|go|java|swift|zig)$/i))
+            complex++;
+        // .ts, .js, .py, .rb, .sh, .css, .html — common scripting/web langs stay neutral (0)
+    }
+    if (simple > 0 && complex === 0)
+        return 0.5;
+    if (complex > 0 && simple === 0)
+        return -0.5;
+    if (complex > 0 && simple > 0)
+        return -0.2; // Complex outweighs simple
+    return 0;
+}
+/**
+ * Compute a claw-affinity score from scope.
  * minor_edit → strongly claw (+1.0)
  * bug_fix → moderate claw (+0.4) — some bugs are complex
  * new_feature → moderate host (-0.3)
@@ -125,17 +151,23 @@ function scopeSignal(scope) {
 }
 /**
  * Compute a claw-affinity score from task description length.
- * Short (< 200 chars) → claw-favoring (+0.5)
+ * Short (< 100 chars) → strongly claw (+1.0)
+ * Short-medium (< 200 chars) → claw (+0.5)
  * Medium (200-500 chars) → neutral (0.0)
- * Long (> 500 chars) → host-favoring (-0.5) — long = complex context
+ * Long (500-1500 chars) → host-favoring (-0.5)
+ * Very long (> 1500 chars) → strongly host (-1.0) due to context complexity
  */
 function lengthSignal(description) {
     const len = description.length;
+    if (len < 100)
+        return 1.0;
     if (len < 200)
         return 0.5;
     if (len <= 500)
         return 0.0;
-    return -0.5;
+    if (len <= 1500)
+        return -0.5;
+    return -1.0;
 }
 /**
  * Detect multi-step task patterns.
@@ -153,8 +185,9 @@ function multiStepSignal(description) {
 // ─── Weights ─────────────────────────────────────────────────
 const WEIGHTS = {
     keyword: 0.35,
-    fileCount: 0.20,
-    scope: 0.25,
+    fileCount: 0.15,
+    fileType: 0.10,
+    scope: 0.20,
     length: 0.10,
     multiStep: 0.10,
 };
@@ -177,6 +210,7 @@ export function computeRoute(args) {
     // ── Compute individual signals ──
     const kw = keywordSignal(task_description);
     const fc = fileCountSignal(files_involved);
+    const ft = fileTypeSignal(files_involved);
     const sc = scopeSignal(estimated_scope);
     const ln = lengthSignal(task_description);
     const ms = multiStepSignal(task_description);
@@ -184,6 +218,7 @@ export function computeRoute(args) {
     // Positive = claw-favoring, Negative = host-favoring
     const composite = kw * WEIGHTS.keyword +
         fc * WEIGHTS.fileCount +
+        ft * WEIGHTS.fileType +
         sc * WEIGHTS.scope +
         ln * WEIGHTS.length +
         ms * WEIGHTS.multiStep;
@@ -206,6 +241,8 @@ export function computeRoute(args) {
         signals.push(`keyword analysis ${kw > 0 ? "favors claw" : "favors host"} (${kw.toFixed(2)})`);
     if (fc !== 0)
         signals.push(`file count signal: ${fc.toFixed(1)}`);
+    if (ft !== 0)
+        signals.push(`file type signal: ${ft.toFixed(1)}`);
     if (sc !== 0)
         signals.push(`scope "${estimated_scope}" signal: ${sc.toFixed(1)}`);
     if (ms !== 0)

package/dist/utils/supabaseApi.js

@@ -1,26 +1,30 @@
-import { SUPABASE_URL, SUPABASE_KEY } from "../config.js";
+// SUPABASE_URL / SUPABASE_KEY are read at call-time from process.env
+// (not import-time) so dashboard-injected credentials are picked up.
 /**
  * Makes a single authenticated HTTP request to the Supabase REST API.
  * All public functions below delegate to this.
  */
 async function supabaseRequest(opts) {
-    // Guard: ensure Supabase is configured before making any request
-    if (!SUPABASE_URL || !SUPABASE_KEY) {
+    // Read credentials at call time (not import time) so that dashboard-injected
+    // values in process.env are picked up after storage/index.ts resolves them.
+    const url = process.env.SUPABASE_URL;
+    const key = process.env.SUPABASE_KEY;
+    if (!url || !key) {
         throw new Error("Supabase not configured (SUPABASE_URL / SUPABASE_KEY missing)");
     }
     // Build the full URL with any query parameters
-    const url = new URL(`${SUPABASE_URL}${opts.path}`);
+    const reqUrl = new URL(`${url}${opts.path}`);
     if (opts.params) {
         for (const [k, v] of Object.entries(opts.params)) {
-            url.searchParams.set(k, v);
+            reqUrl.searchParams.set(k, v);
         }
     }
     // Make the HTTP request with authentication headers
-    const response = await fetch(url.toString(), {
+    const response = await fetch(reqUrl.toString(), {
         method: opts.method,
         headers: {
-            "apikey": SUPABASE_KEY, // Supabase API key (required for all requests)
-            "Authorization": `Bearer ${SUPABASE_KEY}`, // Also passed as Bearer token
+            "apikey": key, // Supabase API key (required for all requests)
+            "Authorization": `Bearer ${key}`, // Also passed as Bearer token
             "Content-Type": "application/json",
             // "Prefer" header controls response behavior:
             //   - "return=representation" means return the inserted/updated row in the response

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "9.0.6",
+  "version": "9.1.1",
   "mcpName": "io.github.dcostenco/prism-mcp",
   "description": "The Mind Palace for AI Agents — a true Cognitive Architecture with Hebbian learning (episodic→semantic consolidation), ACT-R spreading activation (multi-hop causal reasoning), uncertainty-aware rejection gates (agents that know when they don't know), adversarial evaluation (anti-sycophancy), fail-closed Dark Factory pipelines, persistent memory (SQLite/Supabase), multi-agent Hivemind, time travel & visual dashboard. Zero-config local mode.",
   "module": "index.ts",