prism-mcp-server 9.4.2 → 9.4.4

package/README.md

@@ -826,8 +826,9 @@ The Generator strips the `console.log`, resubmits, and the next `EVALUATE` retur
 
 ## 🆕 What's New
 
-> **Current release: v9.4.2 — Shell Injection Fix (Git Drift Detection)**
+> **Current release: v9.4.3 — ESM Bundling Fix (async_hooks)**
 
+- 🔧 **v9.4.3 — ESM Bundling Fix:** Bundled dist had inlined OpenTelemetry CJS `require("async_hooks")` into ESM chunks, causing `Dynamic require of "async_hooks" is not supported` at runtime. Rebuilt with `tsc`. Affects CLI, session save/load, and MCP server startup.
 - 🔒 **v9.4.2 — Shell Injection Fix:** Deep code review found shell injection in `getGitDrift()` — `oldSha` was interpolated into `execSync` template string. Fixed with SHA format validation + `execFileSync` (no shell). Defense-in-depth.
 - 🔒 **v9.4.1 — Security Hardening & Bidirectional Sync:** Two-pass adversarial audit found 18 vulnerabilities (4C/5H/9M) — 17 fixed. Critical: fail-closed rate limiter, path traversal guards, error sanitization. High: plan name alignment (revenue fix), CORS allowlist, settings injection prevention. New: bidirectional `prism sync push` CLI command pushes local SQLite → Supabase, JWT enrichment eliminates N+1 DB queries, concurrency counter guaranteed via `try/finally`, 10MB request body limits.
 - 🎯 **v9.3.0 — TurboQuant ResidualNorm Tiebreaker:** Configurable ranking optimization for Tier-2 search. When compressed cosine scores are within ε of each other, prefers the candidate with lower `residualNorm` (more trustworthy compressed representation). `PRISM_TURBOQUANT_TIEBREAKER_EPSILON=0.005` gives +2pp R@1, +1pp R@5. Empirically validated at N=5K with A/B test. 1066 tests, 0 regressions. Inspired by [@m13v's suggestion](https://github.com/xiaowu0162/LongMemEval/issues/31).

package/dist/lifecycle.js

@@ -8,7 +8,7 @@
 import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { closeConfigStorage } from "./storage/configStorage.js";
 import { getStorage } from "./storage/index.js";
 import { shutdownTelemetry } from "./utils/telemetry.js";
@@ -65,8 +65,12 @@ function isOrphanProcess(pid) {
         return false;
     }
     try {
-        // 'ps -o ppid= -p PID' returns just the parent PID
-        const ppid = execSync(`ps -o ppid= -p ${pid}`, { encoding: "utf8" }).trim();
+        // SECURITY: Use execFileSync (no shell) to prevent command injection.
+        // The PID comes from a file that could be tampered with by another process.
+        const ppid = execFileSync("ps", ["-o", "ppid=", "-p", String(pid)], {
+            encoding: "utf8",
+            timeout: 5000,
+        }).trim();
         return ppid === "1";
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "9.4.2",
+  "version": "9.4.4",
   "mcpName": "io.github.dcostenco/prism-mcp",
   "description": "The Mind Palace for AI Agents — a true Cognitive Architecture with Hebbian learning (episodic→semantic consolidation), ACT-R spreading activation (multi-hop causal reasoning), uncertainty-aware rejection gates (agents that know when they don't know), adversarial evaluation (anti-sycophancy), fail-closed Dark Factory pipelines, persistent memory (SQLite/Supabase), multi-agent Hivemind, time travel & visual dashboard. Zero-config local mode.",
   "module": "index.ts",
@@ -102,7 +102,6 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.81.0",
-    "@google-cloud/discoveryengine": "^2.5.3",
     "@google/generative-ai": "^0.24.1",
     "@libsql/client": "^0.17.2",
     "@modelcontextprotocol/sdk": "^1.27.1",
@@ -116,7 +115,6 @@
     "@tavily/core": "^0.6.0",
     "cheerio": "^1.2.0",
     "commander": "^14.0.3",
-    "dotenv": "^16.5.0",
     "fflate": "^0.8.2",
     "jose": "^6.2.2",
     "jsdom": "^29.0.1",

package/dist/memory/cognitiveBudget.js

@@ -1,224 +0,0 @@
-/**
- * Cognitive Budget — Token-Economic RL (v9.0)
- *
- * ═══════════════════════════════════════════════════════════════════
- * PURPOSE:
- *   Implements a strict token economy for agent memory operations.
- *   Instead of having infinite memory budgets, agents must learn to
- *   save high-signal, compressed entries — through physics, not prompts.
- *
- * ECONOMY DESIGN:
- *   - Budget is PERSISTENT (stored in session_handoffs.cognitive_budget)
- *   - Budget belongs to the PROJECT, not the ephemeral session
- *   - This prevents the "Reset Exploit" (close & reopen to get free tokens)
- *   - Revenue comes from Universal Basic Income (time-based) + success bonuses
- *   - No retrieval-based earning (prevents the "Minting Exploit" / search spam)
- *
- * COST MULTIPLIERS:
- *   Incoming entry surprisal determines the budget cost multiplier:
- *   - Low surprisal (boilerplate): 2.0× cost — penalizes "I updated CSS"
- *   - Normal surprisal:            1.0× cost — standard rate
- *   - High surprisal (novel):      0.5× cost — rewards novel insights
- *
- * GRACEFUL DEGRADATION:
- *   Budget exhaustion produces a WARNING in the MCP response but NEVER
- *   blocks the SQL insert. We never lose agent work due to verbosity.
- *
- * MINIMUM BASE COST:
- *   Empty/trivial summaries still bleed the budget (10 token minimum)
- *   to prevent zero-cost gaming with empty saves.
- *
- * UBI (UNIVERSAL BASIC INCOME):
- *   Instead of earning through arbitrary search spam, agents earn
- *   budget passively through time elapsed since last save:
- *   - +100 tokens per hour since last ledger save (capped at +500/session)
- *   - +200 bonus for a `success` experience event
- *   - +100 bonus for a `learning` experience event
- *
- * FILES THAT IMPORT THIS:
- *   - src/tools/ledgerHandlers.ts (budget tracking + diagnostics)
- *   - src/tools/ledgerHandlers.ts (budget persistence in handoff)
- * ═══════════════════════════════════════════════════════════════════
- */
-// ─── Constants ────────────────────────────────────────────────
-/** Default initial budget per project (tokens) */
-export const DEFAULT_BUDGET_SIZE = 2000;
-/** Minimum base cost per save operation (tokens) — prevents zero-cost gaming */
-export const MINIMUM_BASE_COST = 10;
-/** UBI: tokens earned per hour since last save */
-export const UBI_TOKENS_PER_HOUR = 100;
-/** UBI: maximum tokens earnable via time-based UBI per session */
-export const UBI_MAX_PER_SESSION = 500;
-/** Bonus tokens for saving a `success` experience event */
-export const SUCCESS_BONUS = 200;
-/** Bonus tokens for saving a `learning` experience event */
-export const LEARNING_BONUS = 100;
-/** Budget warning threshold (below this, show advisory) */
-export const LOW_BUDGET_THRESHOLD = 300;
-// ─── Cost Multipliers ────────────────────────────────────────
-/** Surprisal thresholds for cost multiplier tiers */
-export const BOILERPLATE_THRESHOLD = 0.2;
-export const NOVEL_THRESHOLD = 0.7;
-/**
- * Compute the cost multiplier based on content surprisal.
- *
- * - Low surprisal (< 0.2): 2.0× — penalizes boilerplate
- * - Normal surprisal (0.2 - 0.7): 1.0× — standard rate
- * - High surprisal (> 0.7): 0.5× — rewards novel insights
- *
- * @param surprisal - Surprisal score in [0.0, 1.0]
- * @returns Cost multiplier
- */
-export function computeCostMultiplier(surprisal) {
-    if (!Number.isFinite(surprisal))
-        return 1.0;
-    if (surprisal < BOILERPLATE_THRESHOLD)
-        return 2.0;
-    if (surprisal > NOVEL_THRESHOLD)
-        return 0.5;
-    return 1.0;
-}
-// ─── Token Counting ───────────────────────────────────────────
-/**
- * Estimate token count from text using the standard 1 token ≈ 4 chars.
- * Enforces the minimum base cost to prevent zero-cost gaming.
- *
- * @param text - The text to estimate tokens for
- * @returns Estimated token count (minimum: MINIMUM_BASE_COST)
- */
-export function estimateTokens(text) {
-    if (!text || text.trim().length === 0)
-        return MINIMUM_BASE_COST;
-    return Math.max(MINIMUM_BASE_COST, Math.ceil(text.length / 4));
-}
-// ─── UBI Calculator ───────────────────────────────────────────
-/**
- * Compute Universal Basic Income tokens earned since last save.
- *
- * @param lastSaveTime - ISO timestamp of last ledger save (or null if first save)
- * @param currentTime - Current time (default: now)
- * @returns Tokens earned via UBI (capped at UBI_MAX_PER_SESSION)
- */
-export function computeUBI(lastSaveTime, currentTime = new Date()) {
-    if (!lastSaveTime)
-        return 0; // First save — no UBI
-    const lastSave = new Date(lastSaveTime);
-    if (isNaN(lastSave.getTime()))
-        return 0;
-    const hoursSinceLastSave = (currentTime.getTime() - lastSave.getTime()) / (1000 * 60 * 60);
-    if (hoursSinceLastSave <= 0)
-        return 0;
-    // NOTE: Do NOT use Math.floor here — it destroys fractional earnings.
-    // An agent saving every 15 min computes floor(0.25 * 100) = 0 tokens.
-    // Since cognitive_budget is REAL (SQLite) / float8 (Postgres), fractional
-    // values are natively supported. Only round at the UI display layer.
-    const earned = hoursSinceLastSave * UBI_TOKENS_PER_HOUR;
-    return Math.min(earned, UBI_MAX_PER_SESSION);
-}
-/**
- * Compute bonus tokens for specific experience event types.
- *
- * @param eventType - The experience event type
- * @returns Bonus tokens to add to budget
- */
-export function computeEventBonus(eventType) {
-    switch (eventType) {
-        case 'success': return SUCCESS_BONUS;
-        case 'learning': return LEARNING_BONUS;
-        default: return 0;
-    }
-}
-// ─── Budget Manager ───────────────────────────────────────────
-/**
- * Stateless budget operations.
- *
- * The budget is stored as a number in session_handoffs.cognitive_budget.
- * These functions compute the new balance — they don't persist anything.
- * The caller (ledgerHandlers.ts) is responsible for persistence.
- */
-/**
- * Process a budget spend operation.
- *
- * @param currentBalance - Current budget balance
- * @param rawTokenCost - Raw token cost of the entry
- * @param surprisal - Surprisal score of the content [0, 1]
- * @param budgetSize - Initial budget size (for diagnostics)
- * @returns BudgetResult with new balance, warnings, and diagnostics
- */
-export function spendBudget(currentBalance, rawTokenCost, surprisal, budgetSize = DEFAULT_BUDGET_SIZE) {
-    const safeCost = Math.max(MINIMUM_BASE_COST, rawTokenCost);
-    const multiplier = computeCostMultiplier(surprisal);
-    const adjustedCost = Math.ceil(safeCost * multiplier);
-    const newBalance = currentBalance - adjustedCost;
-    const remaining = Math.max(0, newBalance);
-    let warning;
-    if (newBalance <= 0) {
-        warning = `⚠️ Cognitive budget exhausted (${remaining}/${budgetSize} tokens). ` +
-            'Consider saving more concise, high-signal entries. ' +
-            'Budget recovers passively over time (+100 tokens/hour).';
-    }
-    else if (newBalance < LOW_BUDGET_THRESHOLD) {
-        warning = `⚡ Cognitive budget running low (${remaining}/${budgetSize} tokens). ` +
-            'Prioritize novel, dense entries to reduce cost.';
-    }
-    return {
-        allowed: true, // Always allow — graceful degradation
-        spent: adjustedCost,
-        remaining,
-        warning,
-        surprisal,
-        costMultiplier: multiplier,
-    };
-}
-/**
- * Apply Universal Basic Income + event bonuses to a budget balance.
- *
- * @param currentBalance - Current budget balance
- * @param lastSaveTime - ISO timestamp of last save
- * @param eventType - Optional event type for bonus
- * @param budgetSize - Maximum budget cap
- * @returns New balance after UBI + bonuses (capped at budgetSize)
- */
-export function applyEarnings(currentBalance, lastSaveTime, eventType, budgetSize = DEFAULT_BUDGET_SIZE) {
-    const ubiEarned = computeUBI(lastSaveTime);
-    const bonusEarned = computeEventBonus(eventType);
-    // Cap at initial budget size — can't exceed maximum
-    const newBalance = Math.min(budgetSize, currentBalance + ubiEarned + bonusEarned);
-    return { newBalance, ubiEarned, bonusEarned };
-}
-/**
- * Format budget diagnostics for inclusion in MCP response text.
- *
- * @param result - The BudgetResult from spendBudget()
- * @param budgetSize - Initial budget size
- * @param ubiEarned - Tokens earned from UBI this operation
- * @param bonusEarned - Tokens earned from event bonus
- * @returns Formatted diagnostic string
- */
-export function formatBudgetDiagnostics(result, budgetSize = DEFAULT_BUDGET_SIZE, ubiEarned = 0, bonusEarned = 0) {
-    const parts = [];
-    // Budget line
-    const barLength = 20;
-    const fillLength = Math.round((result.remaining / budgetSize) * barLength);
-    const bar = '█'.repeat(Math.max(0, fillLength)) + '░'.repeat(Math.max(0, barLength - fillLength));
-    parts.push(`💰 Budget: ${bar} ${result.remaining}/${budgetSize}`);
-    // Surprisal line
-    if (result.surprisal !== undefined) {
-        const surprisalLabel = result.surprisal < BOILERPLATE_THRESHOLD ? 'boilerplate'
-            : result.surprisal > NOVEL_THRESHOLD ? 'novel'
-                : 'standard';
-        parts.push(`📊 Surprisal: ${result.surprisal.toFixed(2)} (${surprisalLabel}) — cost: ${result.costMultiplier?.toFixed(1)}×`);
-    }
-    // Cost line
-    parts.push(`🪙 Spent: ${result.spent} tokens`);
-    // Earnings line (if any)
-    if (ubiEarned > 0 || bonusEarned > 0) {
-        const earningParts = [];
-        if (ubiEarned > 0)
-            earningParts.push(`+${Math.round(ubiEarned)} UBI`);
-        if (bonusEarned > 0)
-            earningParts.push(`+${Math.round(bonusEarned)} bonus`);
-        parts.push(`📈 Earned: ${earningParts.join(', ')}`);
-    }
-    return parts.join('\n');
-}

package/dist/memory/surprisalGate.js

@@ -1,119 +0,0 @@
-/**
- * Surprisal Gate — Vector-Based Novelty Scoring (v9.0)
- *
- * ═══════════════════════════════════════════════════════════════════
- * PURPOSE:
- *   Computes the information-theoretic "surprisal" of an incoming
- *   memory entry by measuring its semantic distance from recent entries.
- *
- * WHY NOT TF-IDF:
- *   A naive TF-IDF approach would require downloading all summaries
- *   into V8 memory and running a custom JS tokenizer. On projects with
- *   10K+ entries (common after Universal Import), this blocks the
- *   Node.js event loop for seconds, causing MCP handshake timeouts.
- *
- * VECTOR-BASED SURPRISAL:
- *   Surprisal = 1 - max_similarity_to_recent_entries
- *
- *   When the agent tries to save an entry, we embed the summary
- *   (already happening in the save flow) and query the DB for the
- *   single most similar entry from the last 7 days.
- *
- *   - Similarity 0.95 → Surprisal 0.05 → "You're repeating yourself" → 2× cost
- *   - Similarity 0.40 → Surprisal 0.60 → "Completely novel thought" → 0.5× cost
- *
- *   This uses the existing native sqlite-vec index, takes < 5ms,
- *   uses zero extra memory, and is far more accurate than word counting.
- *
- * FILES THAT IMPORT THIS:
- *   - src/tools/ledgerHandlers.ts (surprisal computation during save)
- * ═══════════════════════════════════════════════════════════════════
- */
-import { debugLog } from "../utils/logger.js";
-// ─── Constants ────────────────────────────────────────────────
-/** Maximum age of entries to compare against (days) */
-export const RECENCY_WINDOW_DAYS = 7;
-/** Number of similar entries to fetch for comparison */
-export const TOP_K = 1;
-/** Similarity above which content is considered boilerplate */
-export const BOILERPLATE_SIMILARITY = 0.80;
-/** Similarity below which content is considered novel */
-export const NOVEL_SIMILARITY = 0.30;
-// ─── Core Computation ─────────────────────────────────────────
-/**
- * Compute surprisal from a semantic similarity score.
- *
- * This is the pure math core — no I/O. The caller is responsible
- * for running the actual vector search to find maxSimilarity.
- *
- * @param maxSimilarity - Cosine similarity to the most similar recent entry (0-1)
- * @returns SurprisalResult with classification
- */
-export function computeSurprisal(maxSimilarity) {
-    // Guard: no recent entries found (first entry in project) → maximum novelty
-    if (!Number.isFinite(maxSimilarity) || maxSimilarity < 0) {
-        return {
-            surprisal: 1.0,
-            maxSimilarity: 0.0,
-            isBoilerplate: false,
-            isNovel: true,
-        };
-    }
-    // Clamp to [0, 1]
-    const clamped = Math.min(1.0, Math.max(0.0, maxSimilarity));
-    const surprisal = 1.0 - clamped;
-    return {
-        surprisal,
-        maxSimilarity: clamped,
-        isBoilerplate: clamped >= BOILERPLATE_SIMILARITY,
-        isNovel: clamped <= NOVEL_SIMILARITY,
-    };
-}
-/**
- * Compute surprisal using the existing storage backend's vector search.
- *
- * This is the integration wrapper. It:
- * 1. Takes the query embedding (already generated for the save flow)
- * 2. Finds the most similar recent entry via sqlite-vec
- * 3. Computes surprisal = 1 - max_similarity
- *
- * Falls back to surprisal=0.5 (neutral) on any error, to avoid
- * blocking saves due to search failures.
- *
- * @param searchFn - The storage backend's searchMemory function
- * @param queryEmbedding - JSON-stringified embedding of the new entry
- * @param project - Project scope
- * @param userId - Tenant ID
- * @returns SurprisalResult
- */
-export async function computeVectorSurprisal(searchFn, queryEmbedding, project, userId) {
-    try {
-        // Search for the single most similar recent entry
-        // Using a very low threshold (0.0) to get the closest match regardless
-        const results = await searchFn({
-            queryEmbedding,
-            project,
-            limit: TOP_K,
-            similarityThreshold: 0.0, // Get closest match regardless of distance
-            userId,
-        });
-        if (results.length === 0) {
-            // No existing entries → fully novel
-            debugLog('[surprisal] No recent entries found — maximum novelty');
-            return computeSurprisal(-1);
-        }
-        const maxSimilarity = results[0].similarity;
-        debugLog(`[surprisal] Max similarity to recent entries: ${maxSimilarity.toFixed(3)}`);
-        return computeSurprisal(maxSimilarity);
-    }
-    catch (err) {
-        // Non-fatal: fall back to neutral surprisal
-        debugLog(`[surprisal] Vector search failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
-        return {
-            surprisal: 0.5,
-            maxSimilarity: 0.5,
-            isBoilerplate: false,
-            isNovel: false,
-        };
-    }
-}

package/dist/memory/synapseEngine.js

@@ -1,248 +0,0 @@
-/**
- * Synapse — Spreading Activation Engine (v8.0)
- *
- * ═══════════════════════════════════════════════════════════════════
- * PURPOSE:
- *   Multi-hop energy propagation through the memory_links graph.
- *   Replaces both the old SQL-coupled spreadingActivation.ts AND the
- *   shallow 1-hop candidateScopedSpreadingActivation() from v7.0.
- *
- * PAPER BASIS:
- *   ACT-R spreading activation (Anderson, 2004) extended with:
- *   - Dampened fan effect: 1/ln(degree + e)
- *   - Asymmetric bidirectional flow (forward 100%, backward 50%)
- *   - Lateral inhibition (soft cap per iteration, hard cap on output)
- *   - Visited-edge tracking to prevent cyclic energy amplification
- *
- * DESIGN:
- *   All functions are PURE — zero I/O, zero imports from storage or SQL.
- *   Link data is fetched via a LinkFetcher callback injected by the caller
- *   (SqliteStorage, SupabaseStorage, or test mock).
- *   NOTE: debugLog (stderr diagnostic) is the sole side effect — it only
- *   fires when PRISM_DEBUG_LOGGING=true and does not affect correctness.
- *
- * PERFORMANCE:
- *   Bounded by O(T × softCap) where T=iterations (default 3) and
- *   softCap=20. Worst case: 3 × 20 node expansions = 60 link fetches.
- *   Typical latency: 5-15ms on SQLite.
- *
- * FILES THAT IMPORT THIS:
- *   - src/storage/sqlite.ts (search methods)
- *   - src/tools/graphHandlers.ts (ACT-R re-ranking pipeline)
- * ═══════════════════════════════════════════════════════════════════
- */
-import { debugLog } from "../utils/logger.js";
-// ─── Default Configuration ────────────────────────────────────
-export const DEFAULT_SYNAPSE_CONFIG = {
-    iterations: 3,
-    spreadFactor: 0.8,
-    lateralInhibition: 7,
-    softCap: 20,
-};
-// ─── Sigmoid Normalization ────────────────────────────────────
-/**
- * Squash activation energy into [0, 1] using a parameterized sigmoid.
- *
- * This prevents raw activation energy from overpowering the similarity
- * component in the hybrid score. Without normalization, a node with
- * 10 inbound paths could accumulate energy > 5.0, making the 0.3 weight
- * mathematically dominate the 0.7 similarity weight.
- *
- * Calibration:
- *   midpoint = 0.5 — an activation of 0.5 maps to sigmoid output 0.5
- *   steepness = 2.0 — moderate discrimination
- *
- * @param energy - Raw accumulated activation energy
- * @returns Normalized energy in (0, 1)
- */
-export function normalizeActivationEnergy(energy) {
-    if (!Number.isFinite(energy)) {
-        return energy > 0 ? 1.0 : 0.0;
-    }
-    const midpoint = 0.5;
-    const steepness = 2.0;
-    const exponent = -steepness * (energy - midpoint);
-    if (exponent > 500)
-        return 0;
-    if (exponent < -500)
-        return 1;
-    return 1 / (1 + Math.exp(exponent));
-}
-// ─── Core Engine ──────────────────────────────────────────────
-/**
- * Propagate activation energy through the memory_links graph.
- *
- * Algorithm:
- *   1. Initialize active nodes with anchor similarity scores
- *   2. For each iteration:
- *      a. Fetch ALL links connected to active nodes (via LinkFetcher)
- *      b. Compute per-source fan effect: 1 / ln(out-degree + e)
- *      c. Forward flow: source → target at S × strength × sourceEnergy / dampedFan
- *      d. Backward flow: target → source at (S × 0.5) × strength × targetEnergy
- *      e. Track visited edges to prevent cyclic re-traversal
- *      f. Soft lateral inhibition: keep top-softCap nodes
- *   3. Final lateral inhibition: return top-M nodes
- *
- * @param anchors - Map of entry ID → initial activation (typically similarity score)
- * @param linkFetcher - Async callback to batch-fetch links
- * @param config - Engine configuration (uses defaults if omitted)
- * @returns Array of SynapseResult sorted by activationEnergy descending
- */
-export async function propagateActivation(anchors, linkFetcher, config = {}) {
-    const startMs = performance.now();
-    const cfg = { ...DEFAULT_SYNAPSE_CONFIG, ...config };
-    // Validate: spreadFactor must be < 1.0 for convergence guarantee
-    if (cfg.spreadFactor >= 1.0) {
-        debugLog(`[synapse] WARNING: spreadFactor=${cfg.spreadFactor} >= 1.0, clamping to 0.99`);
-        cfg.spreadFactor = 0.99;
-    }
-    // Clamp minimums to prevent silent result drops
-    if (cfg.lateralInhibition < 1)
-        cfg.lateralInhibition = 1;
-    if (cfg.softCap < 1)
-        cfg.softCap = 1;
-    // State: current activation energy per node
-    let activeNodes = new Map();
-    // Track minimum hop distance from any anchor
-    const hopDistance = new Map();
-    // Track visited edges to prevent cyclic re-traversal
-    const visitedEdges = new Set();
-    // v9.0: Track energy flow weights for valence propagation
-    // Maps targetId → Array<{ sourceId, weight }> representing which nodes
-    // contributed energy and how much. Used by propagateValence() to compute
-    // energy-weighted average valence for discovered nodes.
-    const flowWeights = new Map();
-    // Total edges traversed for telemetry
-    let totalEdgesTraversed = 0;
-    // Initialize with anchor scores
-    for (const [id, score] of anchors) {
-        activeNodes.set(id, score);
-        hopDistance.set(id, 0);
-    }
-    // Short-circuit: no iterations = return anchors as-is
-    if (cfg.iterations <= 0 || anchors.size === 0) {
-        const results = buildResults(activeNodes, anchors, hopDistance, cfg.lateralInhibition);
-        return {
-            results,
-            telemetry: buildTelemetry(results, anchors, 0, 0, startMs),
-            flowWeights: new Map(),
-        };
-    }
-    // ─── Propagation Loop ────────────────────────────────────
-    for (let t = 0; t < cfg.iterations; t++) {
-        const currentIds = Array.from(activeNodes.keys());
-        if (currentIds.length === 0)
-            break;
-        // Fetch ALL links connected to currently active nodes
-        // No global LIMIT — engine controls explosion via softCap
-        let edges;
-        try {
-            edges = await linkFetcher(currentIds);
-        }
-        catch (err) {
-            debugLog(`[synapse] Link fetch failed at iteration ${t} (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
-            break;
-        }
-        totalEdgesTraversed += edges.length;
-        // Compute out-degree per active source node (for forward fan effect)
-        const outDegree = new Map();
-        for (const edge of edges) {
-            if (activeNodes.has(edge.source_id)) {
-                outDegree.set(edge.source_id, (outDegree.get(edge.source_id) || 0) + 1);
-            }
-        }
-        // Compute in-degree per active target node (for backward fan effect)
-        const inDegree = new Map();
-        for (const edge of edges) {
-            if (activeNodes.has(edge.target_id)) {
-                inDegree.set(edge.target_id, (inDegree.get(edge.target_id) || 0) + 1);
-            }
-        }
-        // Next-iteration activation: starts with current values (activation persists)
-        const nextNodes = new Map(activeNodes);
-        for (const edge of edges) {
-            const edgeKey = `${edge.source_id}->${edge.target_id}`;
-            const strength = Number.isFinite(edge.strength) ? Math.max(0, Math.min(1, edge.strength)) : 0;
-            // ── Forward flow: source is active, flows to target ──
-            if (activeNodes.has(edge.source_id) && !visitedEdges.has(edgeKey)) {
-                visitedEdges.add(edgeKey);
-                const sourceEnergy = activeNodes.get(edge.source_id);
-                const degree = outDegree.get(edge.source_id) || 1;
-                // Dampened fan effect: prevents hub nodes from broadcasting equally
-                const dampedFan = Math.log(degree + Math.E);
-                const flow = cfg.spreadFactor * (strength * sourceEnergy / dampedFan);
-                nextNodes.set(edge.target_id, (nextNodes.get(edge.target_id) || 0) + flow);
-                // v9.0: Record flow for valence propagation
-                if (!flowWeights.has(edge.target_id))
-                    flowWeights.set(edge.target_id, []);
-                flowWeights.get(edge.target_id).push({ sourceId: edge.source_id, weight: flow });
-                // Track hop distance (minimum)
-                const sourceHops = hopDistance.get(edge.source_id) ?? 0;
-                const currentTargetHops = hopDistance.get(edge.target_id);
-                if (currentTargetHops === undefined || sourceHops + 1 < currentTargetHops) {
-                    hopDistance.set(edge.target_id, sourceHops + 1);
-                }
-            }
-            // ── Backward flow: target is active, flows backward to source at 50% ──
-            const reverseEdgeKey = `${edge.target_id}->${edge.source_id}`;
-            if (activeNodes.has(edge.target_id) && !visitedEdges.has(reverseEdgeKey)) {
-                visitedEdges.add(reverseEdgeKey);
-                const targetEnergy = activeNodes.get(edge.target_id);
-                // Dampened fan effect for backward flow: prevents hub nodes with many
-                // inbound edges from blasting energy to all sources equally.
-                const inDegreeCount = inDegree.get(edge.target_id) || 1;
-                const dampedFanBack = Math.log(inDegreeCount + Math.E);
-                const flow = (cfg.spreadFactor * 0.5) * (strength * targetEnergy / dampedFanBack);
-                nextNodes.set(edge.source_id, (nextNodes.get(edge.source_id) || 0) + flow);
-                // v9.0: Record backward flow for valence propagation
-                if (!flowWeights.has(edge.source_id))
-                    flowWeights.set(edge.source_id, []);
-                flowWeights.get(edge.source_id).push({ sourceId: edge.target_id, weight: flow });
-                // Track hop distance for backward discoveries
-                const targetHops = hopDistance.get(edge.target_id) ?? 0;
-                const currentSourceHops = hopDistance.get(edge.source_id);
-                if (currentSourceHops === undefined || targetHops + 1 < currentSourceHops) {
-                    hopDistance.set(edge.source_id, targetHops + 1);
-                }
-            }
-        }
-        // Soft lateral inhibition: keep only top-softCap nodes to prevent explosion
-        const sorted = Array.from(nextNodes.entries()).sort((a, b) => b[1] - a[1]);
-        activeNodes = new Map(sorted.slice(0, cfg.softCap));
-    }
-    // ─── Final Output ────────────────────────────────────────
-    const results = buildResults(activeNodes, anchors, hopDistance, cfg.lateralInhibition);
-    return {
-        results,
-        telemetry: buildTelemetry(results, anchors, cfg.iterations, totalEdgesTraversed, startMs),
-        flowWeights,
-    };
-}
-// ─── Helpers ──────────────────────────────────────────────────
-function buildResults(activeNodes, anchors, hopDistance, lateralInhibition) {
-    // Sort by activation energy descending, then apply hard lateral inhibition
-    const sorted = Array.from(activeNodes.entries())
-        .sort((a, b) => b[1] - a[1])
-        .slice(0, lateralInhibition);
-    return sorted.map(([id, energy]) => ({
-        id,
-        activationEnergy: energy,
-        hopsFromAnchor: hopDistance.get(id) ?? 0,
-        isDiscovered: !anchors.has(id),
-    }));
-}
-function buildTelemetry(results, anchors, iterations, edgesTraversed, startMs) {
-    const energies = results.map(r => r.activationEnergy);
-    const discovered = results.filter(r => !anchors.has(r.id)).length;
-    return {
-        nodesReturned: results.length,
-        nodesDiscovered: discovered,
-        maxActivationEnergy: energies.length > 0 ? Math.max(...energies) : 0,
-        avgActivationEnergy: energies.length > 0
-            ? energies.reduce((a, b) => a + b, 0) / energies.length
-            : 0,
-        iterationsPerformed: iterations,
-        edgesTraversed,
-        durationMs: Math.round(performance.now() - startMs),
-    };
-}

package/dist/memory/valenceEngine.js

@@ -1,234 +0,0 @@
-/**
- * Valence Engine — Affect-Tagged Memory (v9.0)
- *
- * ═══════════════════════════════════════════════════════════════════
- * PURPOSE:
- *   Implements Affective Cognitive Routing — every memory gets a
- *   "gut feeling" score from -1.0 (trauma) to +1.0 (success).
- *   Agents get warned when approaching historically problematic
- *   topics, and get green-light signals for proven-successful paths.
- *
- * AFFECTIVE SALIENCE PRINCIPLE:
- *   In human psychology, highly emotional memories — both extreme
- *   joy and extreme trauma — are retrieved MORE easily, not less.
- *   Therefore, the retrieval score uses |valence| (absolute magnitude)
- *   to BOOST salience, while the SIGN (±) is used purely for
- *   prompt injection / UX warnings.
- *
- *   This prevents the Valence Retrieval Paradox where a failure
- *   memory gets pushed below the retrieval threshold, causing the
- *   agent to repeat the exact same mistake.
- *
- * DESIGN:
- *   All functions are PURE — zero I/O, zero imports from storage.
- *   Valence propagation through the Synapse graph uses energy-weighted
- *   transfer with fan-dampened flow and strict [-1, 1] clamping.
- *
- * FILES THAT IMPORT THIS:
- *   - src/storage/sqlite.ts (auto-derive valence on save)
- *   - src/tools/graphHandlers.ts (hybrid scoring + UX warnings)
- *   - src/memory/synapseEngine.ts (valence propagation)
- * ═══════════════════════════════════════════════════════════════════
- */
-// ─── Valence Derivation ───────────────────────────────────────
-/**
- * Deterministic mapping from experience event type to valence score.
- *
- * | Event Type          | Valence | Rationale                          |
- * |---------------------|---------|------------------------------------|
- * | success             | +0.8    | Positive reinforcement             |
- * | failure             | -0.8    | Strong negative signal             |
- * | correction          | -0.6    | User had to fix agent              |
- * | learning            | +0.4    | New knowledge acquired             |
- * | validation_result   | ±0.6    | Pass → +0.6, Fail → -0.6          |
- * | session / default   | 0.0     | Neutral — no sentiment signal      |
- *
- * @param eventType - The experience event type from session_ledger
- * @param notes - Optional notes field (for validation_result pass/fail)
- * @returns Valence score in [-1.0, +1.0]
- */
-export function deriveValence(eventType, notes) {
-    if (!eventType || eventType === 'session')
-        return 0.0;
-    switch (eventType) {
-        case 'success':
-            return 0.8;
-        case 'failure':
-            return -0.8;
-        case 'correction':
-            return -0.6;
-        case 'learning':
-            return 0.4;
-        case 'validation_result':
-            // Check notes for pass/fail indication
-            if (notes) {
-                const lower = notes.toLowerCase();
-                if (lower.includes('pass') || lower.includes('success') || lower.includes('green')) {
-                    return 0.6;
-                }
-                if (lower.includes('fail') || lower.includes('error') || lower.includes('blocked')) {
-                    return -0.6;
-                }
-            }
-            // Ambiguous validation result → slightly negative (cautious)
-            return -0.2;
-        default:
-            return 0.0;
-    }
-}
-// ─── Retrieval Salience (Magnitude-Based) ─────────────────────
-/**
- * Compute the retrieval salience boost from valence.
- *
- * Uses ABSOLUTE MAGNITUDE — both extreme positive and extreme negative
- * memories are more salient (more retrievable). The sign is preserved
- * separately for UX warnings.
- *
- * @param valence - Raw valence score in [-1.0, +1.0]
- * @returns Salience boost in [0.0, 1.0]
- */
-export function valenceSalience(valence) {
-    if (valence == null || !Number.isFinite(valence))
-        return 0.0;
-    return Math.min(1.0, Math.abs(valence));
-}
-// ─── UX Warning / Signal Tags ─────────────────────────────────
-/**
- * Format a valence score into a human-readable emoji tag for display
- * in search results and context output.
- *
- * @param valence - Raw valence score in [-1.0, +1.0]
- * @returns Emoji tag string, or empty string for neutral
- */
-export function formatValenceTag(valence) {
-    if (valence == null || !Number.isFinite(valence))
-        return '';
-    if (valence <= -0.5)
-        return '🔴';
-    if (valence <= -0.2)
-        return '🟠';
-    if (valence >= 0.5)
-        return '🟢';
-    if (valence >= 0.2)
-        return '🔵';
-    return '🟡'; // Neutral zone (-0.2 to +0.2)
-}
-/**
- * Determine if a set of retrieved memories should trigger a
- * negative valence warning in the response.
- *
- * @param avgValence - Average valence across top results
- * @param threshold - Warning threshold (default: -0.3)
- * @returns true if the agent should be warned about historical friction
- */
-export function shouldWarnNegativeValence(avgValence, threshold = -0.3) {
-    return Number.isFinite(avgValence) && avgValence < threshold;
-}
-/**
- * Generate a contextual warning message based on average valence.
- *
- * @param avgValence - Average valence across top results
- * @returns Warning/signal string to inject into MCP response, or null
- */
-export function generateValenceWarning(avgValence) {
-    if (!Number.isFinite(avgValence))
-        return null;
-    if (avgValence < -0.5) {
-        return '⚠️ **Caution:** This topic is strongly correlated with historical failures and corrections. Consider reviewing past decisions before proceeding.';
-    }
-    if (avgValence < -0.3) {
-        return '⚠️ **Warning:** This area has mixed historical outcomes. Approach with awareness of prior friction.';
-    }
-    if (avgValence > 0.5) {
-        return '🟢 **High Signal:** This path has historically led to successful outcomes.';
-    }
-    return null;
-}
-/**
- * Propagate valence through Synapse activation results.
- *
- * Each node's propagated valence is computed as the energy-weighted
- * average of its sources' valence, with fan-dampening to prevent
- * hub explosion. The final value is strictly clamped to [-1.0, +1.0].
- *
- * IMPORTANT — Fan-Dampening:
- *   If 50 neutral nodes point to 1 negative node, the negative valence
- *   must NOT multiply to -50.0. The incoming valence is averaged over
- *   the fan-in count, then clamped.
- *
- * Algorithm:
- *   For each non-anchor node with incoming energy flows:
- *     propagatedValence = Σ(flow_weight × source_valence) / Σ(flow_weight)
- *   Clamped to [-1.0, +1.0].
- *
- *   Anchor nodes retain their original valence unchanged.
- *
- * @param synapseResults - Node IDs with their activation energy from Synapse
- * @param valenceLookup - Map from entry ID → raw valence (from DB)
- * @param flowWeights - Map from `targetId` → Array<{ sourceId, weight }> representing
- *                      the energy flows that contributed to each node's activation
- * @returns Map from entry ID → propagated valence
- */
-export function propagateValence(synapseResults, valenceLookup, flowWeights) {
-    const result = new Map();
-    for (const node of synapseResults) {
-        // Anchor nodes: use their direct valence
-        if (!node.isDiscovered) {
-            const directValence = valenceLookup.get(node.id) ?? 0.0;
-            result.set(node.id, clampValence(directValence));
-            continue;
-        }
-        // Discovered nodes: compute energy-weighted average from source flows
-        const flows = flowWeights?.get(node.id);
-        if (!flows || flows.length === 0) {
-            // No flow data → use direct valence if available, else neutral
-            result.set(node.id, clampValence(valenceLookup.get(node.id) ?? 0.0));
-            continue;
-        }
-        let weightedValenceSum = 0;
-        let totalWeight = 0;
-        for (const flow of flows) {
-            const sourceValence = valenceLookup.get(flow.sourceId) ?? result.get(flow.sourceId) ?? 0.0;
-            const absWeight = Math.abs(flow.weight);
-            weightedValenceSum += absWeight * sourceValence;
-            totalWeight += absWeight;
-        }
-        const propagated = totalWeight > 0 ? weightedValenceSum / totalWeight : 0.0;
-        result.set(node.id, clampValence(propagated));
-    }
-    return result;
-}
-/**
- * Clamp a valence value to the valid range [-1.0, +1.0].
- * Returns 0.0 for non-finite values.
- */
-export function clampValence(v) {
-    if (!Number.isFinite(v))
-        return 0.0;
-    return Math.max(-1.0, Math.min(1.0, v));
-}
-// ─── Hybrid Score Component ───────────────────────────────────
-/**
- * Compute the hybrid retrieval score incorporating valence salience.
- *
- * Formula: 0.65 × similarity + 0.25 × normalizedActivation + 0.1 × |valence|
- *
- * The valence component uses ABSOLUTE MAGNITUDE — both extreme positive
- * and extreme negative memories get a retrieval boost. Only the sign
- * matters for UX warnings, not for ranking.
- *
- * @param similarity - Semantic similarity score [0, 1]
- * @param normalizedActivation - Sigmoid-normalized activation energy [0, 1]
- * @param valence - Raw valence score [-1, +1]
- * @param weights - Optional weight overrides
- * @returns Hybrid score in [0, 1]
- */
-export function computeHybridScoreWithValence(similarity, normalizedActivation, valence, weights = {}) {
-    const wSim = weights.similarity ?? 0.65;
-    const wAct = weights.activation ?? 0.25;
-    const wVal = weights.valence ?? 0.10;
-    const safeSim = Number.isFinite(similarity) ? Math.max(0, Math.min(1, similarity)) : 0;
-    const safeAct = Number.isFinite(normalizedActivation) ? Math.max(0, Math.min(1, normalizedActivation)) : 0;
-    const safeVal = valenceSalience(valence); // Already returns [0, 1] magnitude
-    return wSim * safeSim + wAct * safeAct + wVal * safeVal;
-}

package/dist/utils/llm/adapters/ollama.js

@@ -1,153 +0,0 @@
-/**
- * Ollama Adapter (v1.0 — nomic-embed-text)
- * ─────────────────────────────────────────────────────────────────────────────
- * PURPOSE:
- *   Implements LLMProvider using Ollama's native /api/embed REST endpoint for
- *   fully local, zero-cost text embeddings. No API key required — Ollama runs
- *   on localhost.
- *
- * TEXT GENERATION:
- *   This adapter is embeddings-only. generateText() throws an explicit error.
- *   Set text_provider separately (anthropic, openai, or gemini).
- *
- * EMBEDDING DIMENSION PARITY (768 dims):
- *   Prism's SQLite (sqlite-vec) and Supabase (pgvector) schemas define
- *   embedding columns as EXACTLY 768 dimensions.
- *
- *   nomic-embed-text natively outputs 768 dims — zero truncation needed.
- *   It is the recommended default local model for Prism.
- *
- * SUPPORTED MODELS (all confirmed 768-dim via Ollama):
- *   nomic-embed-text     — 768 dims, 274MB, best quality/size trade-off ✅ DEFAULT
- *   nomic-embed-text:v1.5 — 768 dims, 274MB, same (stable alias)
- *
- *   Models to AVOID with this adapter (wrong dim count):
- *   mxbai-embed-large    — 1024 dims ❌  (use OpenAIAdapter instead)
- *   all-minilm           — 384 dims  ❌
- *   snowflake-arctic-embed — varies  ❌
- *
- * BATCH EMBEDDINGS:
- *   Uses /api/embed (plural) which is the official Ollama batch endpoint
- *   introduced in Ollama ≥ 0.3.0. Falls back gracefully for older versions.
- *
- * CONFIG KEYS (Prism dashboard "AI Providers" tab OR environment variables):
- *   ollama_base_url   — Base URL of Ollama server (default: http://localhost:11434)
- *   ollama_model      — Embedding model (default: nomic-embed-text)
- *
- * USAGE:
- *   In the Prism dashboard, set:
- *     embedding_provider = ollama
- *   Optionally set ollama_base_url and ollama_model to override defaults.
- *
- * API REFERENCE:
- *   https://github.com/ollama/ollama/blob/main/docs/api.md#generate-embeddings
- */
-import { getSettingSync } from "../../../storage/configStorage.js";
-import { debugLog } from "../../logger.js";
-// ─── Constants ────────────────────────────────────────────────────────────────
-// Must match Prism's DB schema (sqlite-vec and pgvector column sizes).
-const EMBEDDING_DIMS = 768;
-// Generous character cap — nomic-embed-text has an 8192-token context window.
-const MAX_EMBEDDING_CHARS = 8000;
-const DEFAULT_BASE_URL = "http://localhost:11434";
-const DEFAULT_MODEL = "nomic-embed-text";
-// Connection retry settings — handles the common "forgot to start Ollama" race.
-const MAX_RETRIES = 2;
-const RETRY_DELAY_MS = 500;
-// ─── Adapter ─────────────────────────────────────────────────────────────────
-export class OllamaAdapter {
-    baseUrl;
-    model;
-    constructor() {
-        this.baseUrl = getSettingSync("ollama_base_url", DEFAULT_BASE_URL).replace(/\/$/, "");
-        this.model = getSettingSync("ollama_model", DEFAULT_MODEL);
-        debugLog(`[OllamaAdapter] Initialized — baseUrl=${this.baseUrl}, model=${this.model}`);
-    }
-    // ─── Text Generation (Not Supported) ────────────────────────────────────
-    async generateText(_prompt, _systemInstruction) {
-        throw new Error("OllamaAdapter does not support text generation. " +
-            "Set text_provider to 'anthropic', 'openai', or 'gemini' in the dashboard.");
-    }
-    // ─── Batch Embedding Generation ─────────────────────────────────────────
-    async generateEmbeddings(texts) {
-        if (!texts || texts.length === 0)
-            return [];
-        const model = this.model;
-        // Word-safe truncation — consistent with Voyage and OpenAI adapters.
-        const truncatedTexts = texts.map(text => {
-            if (text.length > MAX_EMBEDDING_CHARS) {
-                const cut = text.slice(0, MAX_EMBEDDING_CHARS);
-                const lastSpace = cut.lastIndexOf(" ");
-                return lastSpace > 0 ? cut.slice(0, lastSpace) : cut;
-            }
-            return text;
-        });
-        debugLog(`[OllamaAdapter] generateEmbeddings — model=${model}, count=${truncatedTexts.length}`);
-        // Retry loop — catches ECONNREFUSED when Ollama service hasn't started yet.
-        let response;
-        let lastError = null;
-        for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-            try {
-                response = await fetch(`${this.baseUrl}/api/embed`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify({ model, input: truncatedTexts }),
-                });
-                if (!response.ok) {
-                    const errorText = await response.text().catch(() => "unknown error");
-                    throw new Error(`[OllamaAdapter] /api/embed request failed — status=${response.status}: ${errorText}. ` +
-                        `Make sure Ollama is running (ollama serve) and '${model}' has been pulled (ollama pull ${model}).`);
-                }
-                // Success — break out of retry loop.
-                lastError = null;
-                break;
-            }
-            catch (err) {
-                lastError = err instanceof Error ? err : new Error(String(err));
-                const isNetworkError = lastError.message.includes("ECONNREFUSED") ||
-                    lastError.message.includes("fetch failed") ||
-                    lastError.message.includes("ECONNRESET");
-                if (isNetworkError && attempt < MAX_RETRIES) {
-                    debugLog(`[OllamaAdapter] Connection failed (attempt ${attempt + 1}/${MAX_RETRIES + 1}): ` +
-                        `${lastError.message.substring(0, 80)}. Retrying in ${RETRY_DELAY_MS}ms...`);
-                    await new Promise(resolve => setTimeout(resolve, RETRY_DELAY_MS));
-                    continue;
-                }
-                throw lastError;
-            }
-        }
-        if (lastError)
-            throw lastError;
-        const data = (await response.json());
-        const embeddings = data?.embeddings;
-        if (!Array.isArray(embeddings) || embeddings.length === 0) {
-            throw new Error(`[OllamaAdapter] Empty embeddings response from model '${model}'.`);
-        }
-        if (embeddings.length !== texts.length) {
-            throw new Error(`[OllamaAdapter] Response length mismatch — expected ${texts.length}, got ${embeddings.length}.`);
-        }
-        // Validate dimensions and slice if model returned > 768 (shouldn't happen
-        // with nomic-embed-text but guards against model swaps).
-        return embeddings.map((emb, i) => {
-            if (emb.length > EMBEDDING_DIMS) {
-                debugLog(`[OllamaAdapter] Embedding[${i}] has ${emb.length} dims — truncating to ${EMBEDDING_DIMS}. ` +
-                    `Consider using a model that natively outputs ${EMBEDDING_DIMS} dims (e.g. nomic-embed-text).`);
-                return emb.slice(0, EMBEDDING_DIMS);
-            }
-            if (emb.length !== EMBEDDING_DIMS) {
-                throw new Error(`[OllamaAdapter] Dimension mismatch at index ${i}: expected ${EMBEDDING_DIMS}, ` +
-                    `got ${emb.length}. Model '${model}' is not compatible with Prism's 768-dim schema. ` +
-                    `Use nomic-embed-text which natively outputs 768 dims.`);
-            }
-            return emb;
-        });
-    }
-    // ─── Single Embedding (delegates to batch) ───────────────────────────────
-    async generateEmbedding(text) {
-        if (!text || !text.trim()) {
-            throw new Error("[OllamaAdapter] generateEmbedding called with empty text.");
-        }
-        const results = await this.generateEmbeddings([text]);
-        return results[0];
-    }
-}