superlocalmemory 3.6.20 → 3.6.22

package/README.md

@@ -2,10 +2,10 @@
   <img src="https://superlocalmemory.com/assets/logo-mark.png" alt="SuperLocalMemory" width="200"/>
 </p>
 
-<h1 align="center">SuperLocalMemory V3.6.18</h1>
+<h1 align="center">SuperLocalMemory V3.6.21</h1>
 <p align="center"><strong>Cache. Compress. Remember. Three surfaces — proxy, MCP tools, or skill. Every setup covered.</strong><br/>
 <em>To the best of our knowledge, the only zero-cloud agent memory that beats Mem0's zero-LLM score on LoCoMo. Mode A: 74.8% vs Mem0 64.2% — no GPU, no API key, on CPU.</em></p>
-<p align="center"><code>v3.6.18</code> — <strong>Plugin-native. Profile-aware. Distributed-ready.</strong><br/>
+<p align="center"><code>v3.6.21</code> — <strong>Plugin-native. Profile-aware. Distributed-ready.</strong><br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>3 published research papers</strong> (arXiv preprints + Zenodo-archived) · <a href="https://arxiv.org/abs/2603.02240">arXiv:2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">arXiv:2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">arXiv:2604.04514</a></p>
 
@@ -307,6 +307,8 @@ slm dashboard    # Opens at http://localhost:8765
 
 | Version | Codename | Key Features |
 |---|---|---|
+| **v3.6.21** | Dashboard Audit | Full UI audit across all 7 dashboard tabs — auth fix for mesh panel (issue #60 frontend), Quick Store endpoint, timeline endpoint, r.ok guards, SSE \r fix, event delegation for lazy tabs, optimize toggle revert; backbone.py JSONDecodeError fix (issue #62) |
+| **v3.6.20** | Mesh Auth | Remote mesh auth fix (issue #60) — `_get_broker` now accepts Bearer + X-Mesh-Secret from non-loopback callers; config settings preservation (AIDEV-86) |
 | **v3.6.17** | Community | 8 contributor PRs (observability events, marker-bounded adapter writes, daemon port discovery, anthropic `api_base`, OpenMP workers, atomic-write rehash, `_jl` sentinel, LFS pointer); dashboard-feedback fix (#53/#59); env-tunable SQLite knobs + idle backoff; remote LLM test-probe (#40) |
 | **v3.6.16** | Docs | Corrected Claude Code plugin install — adds the required `/plugin marketplace add` step; clarifies plugin vs pip/npm delivery |
 | **v3.6.15** | Multi-scope | **Opt-in [shared memory](docs/shared-memory.md)** (personal/shared/global, off by default), default-deny scope at every read path, recall scope-race fix, contributor PRs #42/#43/#44, fixes #46–#49 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "3.6.20",
+  "version": "3.6.22",
   "description": "Information-geometric agent memory with mathematical guarantees. 4-channel retrieval, Fisher-Rao similarity, zero-LLM mode, EU AI Act compliant. Works with Claude, Cursor, Windsurf, and 17+ AI tools.",
   "keywords": [
     "ai-memory",

package/plugin/.claude-plugin/plugin.json

@@ -16,5 +16,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "3.6.20"
+  "version": "3.6.22"
 }

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.6.20
+superlocalmemory==3.6.22

package/plugin-src/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.6.20",
+  "version": "3.6.22",
   "pluginName": "superlocalmemory",
   "displayName": "SuperLocalMemory",
   "repository": "https://github.com/qualixar/superlocalmemory",

package/plugin-src/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.6.20
+superlocalmemory==3.6.22

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superlocalmemory"
-version = "3.6.20"
+version = "3.6.22"
 description = "Information-geometric agent memory with mathematical guarantees"
 readme = "README.md"
 license = {text = "AGPL-3.0-or-later"}

package/src/superlocalmemory/__init__.py

@@ -32,7 +32,7 @@ if "OMP_NUM_THREADS" not in os.environ:
     os.environ["OMP_NUM_THREADS"] = "2"
 # ---------------------------------------------------------------------------
 
-__version__ = "3.6.20"
+__version__ = "3.6.22"
 
 _REQUIRED_VERSIONS = {
     "sentence_transformers": "5.3.0",

package/src/superlocalmemory/llm/backbone.py

@@ -190,7 +190,7 @@ class LLMBackbone:
                     logger.warning("Content filter or bad request (400). Returning empty.")
                     return ""
                 last_error = exc
-            except (httpx.TimeoutException, httpx.ConnectError) as exc:
+            except (httpx.TimeoutException, httpx.ConnectError, ValueError) as exc:
                 last_error = exc
 
             if attempt < _MAX_RETRIES - 1:
@@ -217,7 +217,14 @@ class LLMBackbone:
             with httpx.Client(timeout=timeout) as client:
                 resp = client.post(url, headers=headers, json=payload)
                 resp.raise_for_status()
-                return resp.json()
+                try:
+                    return resp.json()
+                except Exception as exc:
+                    raise ValueError(
+                        f"LLM endpoint returned HTTP {resp.status_code} with "
+                        f"non-JSON body (Content-Length="
+                        f"{resp.headers.get('content-length', '?')}): {exc}"
+                    ) from exc
         finally:
             socket.setdefaulttimeout(old_default)
 

package/src/superlocalmemory/mcp/tools_v3.py

@@ -65,25 +65,13 @@ def register_v3_tools(server, get_engine: Callable) -> None:
                     "error": f"Invalid mode '{mode}'. Use 'a', 'b', or 'c'.",
                 }
             from superlocalmemory.core.config import SLMConfig
-            from superlocalmemory.storage.models import Mode
             from superlocalmemory.mcp.server import reset_engine
 
-            mode_enum = Mode(mode_lower)
+            # Use switch_mode() — the correct load-then-patch path that preserves
+            # all user-tuned config blocks (forgetting, injection, retrieval, scope,
+            # math, channel_weights, …). for_mode() resets them to hardcoded defaults.
             old_config = SLMConfig.load()
-            config = SLMConfig.for_mode(
-                mode_enum,
-                llm_provider=old_config.llm.provider,
-                llm_model=old_config.llm.model,
-                llm_api_key=old_config.llm.api_key,
-                llm_api_base=old_config.llm.api_base,
-                embedding_provider=old_config.embedding.provider,
-                embedding_endpoint=old_config.embedding.api_endpoint,
-                embedding_key=old_config.embedding.api_key,
-                embedding_model_name=old_config.embedding.model_name,
-                embedding_dimension=old_config.embedding.dimension,
-            )
-            config.active_profile = old_config.active_profile
-            config.save(mode_change=True)
+            config = SLMConfig.switch_mode(mode_lower)
 
             # V3.3: Check if embedding model changed — flag for re-indexing
             needs_reindex = (

package/src/superlocalmemory/server/routes/mesh.py

@@ -87,15 +87,23 @@ def _get_broker(request: Request):
         client_host = request.client.host if request.client else ""
         if client_host not in ("127.0.0.1", "::1", "localhost"):
             import hmac
-            # Accept X-Mesh-Secret (undocumented legacy header, v3.6.12 regression) OR
-            # Authorization: Bearer <secret> (RFC 7617 — canonical; what remote_sync.py
-            # sends and what the docs specify). Both are constant-time compared.
+            from superlocalmemory.core.security_primitives import verify_install_token
+
+            # Path 1: install token — dashboard/browser callers hold this and
+            # should not need the mesh secret exposed in JS.
+            install_token = request.headers.get("x-install-token", "")
+            if install_token and verify_install_token(install_token):
+                return broker
+
+            # Path 2: mesh secret — remote agents / remote_sync.py / LAN peers.
+            # Accept X-Mesh-Secret (legacy v3.6.12 header) OR
+            # Authorization: Bearer <secret> (RFC 7617 canonical form).
             presented = (
                 request.headers.get("x-mesh-secret")
                 or request.headers.get("authorization", "").removeprefix("Bearer ").strip()
             )
             if not presented or not hmac.compare_digest(presented, secret):
-                raise HTTPException(401, detail="invalid or missing mesh secret")
+                raise HTTPException(401, detail="invalid or missing credential")
     return broker
 
 

package/src/superlocalmemory/server/routes/v3_api.py

@@ -123,20 +123,17 @@ async def set_mode(request: Request):
                 status_code=400,
             )
 
-        new_config = SLMConfig.for_mode(
-            Mode(new_mode),
-            llm_provider=old_config.llm.provider,
-            llm_model=old_config.llm.model,
-            llm_api_key=old_config.llm.api_key,
-            llm_api_base=old_config.llm.api_base,
-            embedding_provider=old_config.embedding.provider,
-            embedding_endpoint=old_config.embedding.api_endpoint,
-            embedding_key=old_config.embedding.api_key,
-            embedding_model_name=old_config.embedding.model_name,
-            embedding_dimension=old_config.embedding.dimension,
-        )
-        new_config.active_profile = old_config.active_profile
-        new_config.save(mode_change=True)
+        # Apply new mode's structural presets (retrieval, math, channel_weights)
+        # by building a fresh template, then graft them onto the loaded config so
+        # all user-tuned blocks (forgetting, injection, consolidation, scope, …)
+        # are preserved across the mode switch.
+        _template = SLMConfig.for_mode(Mode(new_mode))
+        old_config.mode = Mode(new_mode)
+        old_config.retrieval = _template.retrieval
+        old_config.math = _template.math
+        old_config.channel_weights = _template.channel_weights
+        old_config.save(mode_change=True)
+        new_config = old_config
 
         # Audit the change before we lose context — proves who/when/what.
         # Captures the phantom-write case where `for_mode(C)` auto-defaults
@@ -184,35 +181,52 @@ async def set_full_config(request: Request):
         if new_mode not in ("a", "b", "c"):
             return JSONResponse({"error": "Invalid mode"}, status_code=400)
 
-        from superlocalmemory.core.config import SLMConfig
+        from superlocalmemory.core.config import SLMConfig, EmbeddingConfig, LLMConfig
         from superlocalmemory.storage.models import Mode
         from superlocalmemory.server.routes.helpers import log_mode_change
-        old = SLMConfig.load()
-        old_mode = old.mode.value
-        # v3.6.12 (settings-2): honor a custom endpoint for ANY provider — the
-        # old code forced api_base="" for everything except ollama, so a
-        # llama.cpp / LM Studio / Azure-OpenAI endpoint configured in the
-        # dashboard could never be saved (Test Connection then probed the wrong
-        # URL → 401). Accept both base_url and endpoint; default ollama locally.
+        config = SLMConfig.load()
+        old_mode = config.mode.value
+
+        # v3.6.12 (settings-2): honor a custom endpoint for ANY provider.
         _endpoint = (body.get("base_url", "") or body.get("endpoint", "")).strip()
         if not _endpoint and provider == "ollama":
             _endpoint = "http://localhost:11434"
-        config = SLMConfig.for_mode(
-            Mode(new_mode),
-            llm_provider=provider if provider != "none" else "",
-            llm_model=model,
-            llm_api_key=api_key,
-            llm_api_base=_endpoint,
-            embedding_provider=body.get("embedding_provider", ""),
-            embedding_endpoint=body.get("embedding_endpoint", ""),
-            embedding_key=body.get("embedding_key", ""),
-            embedding_model_name=body.get("embedding_model", ""),
-            embedding_dimension=int(body.get("embedding_dimension", 0) or 0),
+
+        # Mutate only the fields the dashboard sent — all other config blocks
+        # (forgetting, injection, retrieval, math, consolidation, scope, …) are
+        # preserved because we loaded the full existing config above.
+        config.mode = Mode(new_mode)
+        config.llm = LLMConfig(
+            provider=provider if provider != "none" else "",
+            model=model,
+            api_key=api_key,
+            api_base=_endpoint,
         )
-        config.active_profile = old.active_profile
-        # v3.6.12 (settings-1): an explicit user-driven mode switch must persist.
-        # save() without mode_change=True hits the guard that PRESERVES the old
-        # mode, so /mode/set silently no-op'd the switch while returning success.
+
+        # Update embedding only when the dashboard explicitly sent those fields;
+        # absence means "leave it alone" (AIDEV-86 / broader fix).
+        _emb_fields = ("embedding_provider", "embedding_endpoint", "embedding_key",
+                       "embedding_model", "embedding_dimension")
+        if any(k in body for k in _emb_fields):
+            config.embedding = EmbeddingConfig(
+                provider=body.get("embedding_provider", ""),
+                api_endpoint=body.get("embedding_endpoint", ""),
+                api_key=body.get("embedding_key", ""),
+                model_name=body.get("embedding_model", ""),
+                dimension=int(body.get("embedding_dimension", 0) or 0),
+            )
+
+        # When the mode actually changed, apply the new mode's structural presets
+        # (retrieval topology, math thresholds, channel weights) so the user gets
+        # the right runtime behaviour for their chosen mode.
+        if new_mode != old_mode:
+            _template = SLMConfig.for_mode(Mode(new_mode))
+            config.retrieval = _template.retrieval
+            config.math = _template.math
+            config.channel_weights = _template.channel_weights
+
+        # v3.6.12 (settings-1): mode_change=True is required to persist the new
+        # mode — save() without it hits a guard that preserves the old mode.
         config.save(mode_change=True)
 
         log_mode_change(
@@ -607,8 +621,7 @@ async def set_provider(request: Request):
         model = body.get("model", "")
         base_url = body.get("base_url", "")
 
-        from superlocalmemory.core.config import SLMConfig
-        from superlocalmemory.storage.models import Mode
+        from superlocalmemory.core.config import SLMConfig, LLMConfig
         config = SLMConfig.load()
 
         # Use preset base_url if not provided
@@ -619,15 +632,14 @@ async def set_provider(request: Request):
             if not model:
                 model = preset.get("model", "")
 
-        new_config = SLMConfig.for_mode(
-            config.mode,
-            llm_provider=provider,
-            llm_model=model,
-            llm_api_key=api_key,
-            llm_api_base=base_url,
+        # Mutate only the LLM block — all other config is preserved.
+        config.llm = LLMConfig(
+            provider=provider,
+            model=model,
+            api_key=api_key,
+            api_base=base_url,
         )
-        new_config.active_profile = config.active_profile
-        new_config.save()
+        config.save()
 
         return {"success": True, "provider": provider, "model": model}
     except Exception as e:

package/src/superlocalmemory/ui/js/auto-settings.js

@@ -52,17 +52,14 @@ function saveAutoRecallConfig() {
     }).catch(function(e) { console.log('Save auto-recall error:', e); });
 }
 
-// Bind change listeners for auto-capture toggles
-document.querySelectorAll('#auto-capture-toggle, #auto-capture-decisions, #auto-capture-bugs').forEach(function(el) {
-    if (el) {
-        el.addEventListener('change', saveAutoCaptureConfig);
-    }
-});
-
-// Bind change listeners for auto-recall toggles
-document.querySelectorAll('#auto-recall-toggle, #auto-recall-session').forEach(function(el) {
-    if (el) {
-        el.addEventListener('change', saveAutoRecallConfig);
+// Use delegation so listeners work even when the settings pane is injected lazily.
+document.addEventListener('change', function(e) {
+    var id = e.target && e.target.id;
+    if (!id) return;
+    if (id === 'auto-capture-toggle' || id === 'auto-capture-decisions' || id === 'auto-capture-bugs') {
+        saveAutoCaptureConfig();
+    } else if (id === 'auto-recall-toggle' || id === 'auto-recall-session') {
+        saveAutoRecallConfig();
     }
 });
 

package/src/superlocalmemory/ui/js/clusters.js

@@ -117,6 +117,7 @@ async function loadClusters() {
     }
     try {
         var response = await fetch('/api/clusters');
+        if (!response.ok) throw new Error('HTTP ' + response.status);
         var data = await response.json();
         _CLUSTERS_STATE.clusters = data.clusters || [];
         _CLUSTERS_STATE.page = 0;

package/src/superlocalmemory/ui/js/compliance.js

@@ -13,6 +13,7 @@ async function loadCompliance() {
         var url = '/api/compliance/status';
         if (filterValue) url += '?event_type=' + encodeURIComponent(filterValue);
         var response = await fetch(url);
+        if (!response.ok) throw new Error('HTTP ' + response.status);
         var data = await response.json();
         _complianceData = data;
 

package/src/superlocalmemory/ui/js/core.js

@@ -416,6 +416,9 @@ function refreshDashboard() {
 function populateFilters(categories, projects) {
     var categorySelect = document.getElementById('filter-category');
     var projectSelect = document.getElementById('filter-project');
+    // Clear existing options beyond the first placeholder to prevent duplicates on refresh
+    if (categorySelect) while (categorySelect.options.length > 1) categorySelect.remove(1);
+    if (projectSelect) while (projectSelect.options.length > 1) projectSelect.remove(1);
     categories.forEach(function(cat) {
         if (cat.category) {
             var option = document.createElement('option');

package/src/superlocalmemory/ui/js/dashboard.js

@@ -63,7 +63,12 @@ document.addEventListener('click', function(e) {
             method: 'PUT',
             headers: {'Content-Type': 'application/json'},
             body: JSON.stringify({mode: mode})
-        }).then(function() { loadDashboard(); });
+        }).then(function(r) {
+            if (!r.ok) return r.json().catch(function() { return {}; }).then(function(d) {
+                showToast('Mode switch failed: ' + (d.error || d.detail || r.status), 'error');
+            });
+            return r.json().then(function() { loadDashboard(); });
+        }).catch(function() { showToast('Mode switch failed: network error', 'error'); });
     }
 });
 
@@ -72,15 +77,21 @@ document.getElementById('quick-store-btn')?.addEventListener('click', function()
     var input = document.getElementById('quick-store-input');
     var content = input.value.trim();
     if (!content) return;
-    fetch('/api/memories', {
+    fetch('/remember', {
         method: 'POST',
         headers: {'Content-Type': 'application/json'},
         body: JSON.stringify({content: content})
-    }).then(function(r) { return r.json(); }).then(function(data) {
+    }).then(function(r) {
+        if (!r.ok) return r.json().catch(function() { return {}; }).then(function(d) {
+            showToast('Store failed: ' + (d.detail || d.error || r.status), 'error');
+        });
+        return r.json();
+    }).then(function(data) {
+        if (!data) return;
         input.value = '';
         loadDashboard();
-        alert('Stored!');
-    });
+        showToast('Stored!');
+    }).catch(function() { showToast('Store failed: network error', 'error'); });
 });
 
 // Quick recall
@@ -91,7 +102,10 @@ document.getElementById('quick-recall-btn')?.addEventListener('click', function(
         method: 'POST',
         headers: {'Content-Type': 'application/json'},
         body: JSON.stringify({query: query, limit: 5})
-    }).then(function(r) { return r.json(); }).then(function(data) {
+    }).then(function(r) {
+        if (!r.ok) throw new Error('HTTP ' + r.status);
+        return r.json();
+    }).then(function(data) {
         var div = document.getElementById('quick-recall-results');
         if (!data.results || data.results.length === 0) {
             div.textContent = 'No results found.';
@@ -113,5 +127,8 @@ document.getElementById('quick-recall-btn')?.addEventListener('click', function(
             row.appendChild(scoreSpan);
             div.appendChild(row);
         });
+    }).catch(function(e) {
+        var div = document.getElementById('quick-recall-results');
+        if (div) div.textContent = 'Search failed. Is the daemon running?';
     });
 });

package/src/superlocalmemory/ui/js/knowledge-graph.js

@@ -618,7 +618,10 @@ function loadGraphSigma() {
     if (typeof showLoadingSpinner === 'function') showLoadingSpinner();
 
     fetch('/api/graph?max_nodes=' + fetchLimit + '&min_importance=' + minImportance)
-        .then(function(r) { return r.json(); })
+        .then(function(r) {
+            if (!r.ok) throw new Error('HTTP ' + r.status);
+            return r.json();
+        })
         .then(function(data) {
             // Store in shared globals
             if (typeof window.graphData !== 'undefined') window.graphData = data;

package/src/superlocalmemory/ui/js/math-health.js

@@ -61,7 +61,11 @@ async function loadMathHealth() {
             var liStatus = document.createElement('li');
             liStatus.appendChild(document.createTextNode('Status: '));
             var statusBadge = document.createElement('span');
-            statusBadge.className = 'badge bg-success';
+            var _s = (layer.status || 'active').toLowerCase();
+            var _badgeClass = _s === 'error' || _s === 'critical' ? 'bg-danger' :
+                              _s === 'warning' || _s === 'degraded' ? 'bg-warning text-dark' :
+                              'bg-success';
+            statusBadge.className = 'badge ' + _badgeClass;
             statusBadge.textContent = layer.status || 'active';
             liStatus.appendChild(statusBadge);
             ul.appendChild(liStatus);

package/src/superlocalmemory/ui/js/memories.js

@@ -41,6 +41,7 @@ async function loadMemories(page) {
     showLoading('memories-list', 'Loading memories...');
     try {
         var response = await fetch(url);
+        if (!response.ok) throw new Error('HTTP ' + response.status);
         var data = await response.json();
         lastSearchResults = null;
         var exportBtn = document.getElementById('export-search-btn');

package/src/superlocalmemory/ui/js/memory-chat.js

@@ -157,7 +157,7 @@ function sendChatQuery(query) {
 
                 var currentEvent = '';
                 for (var i = 0; i < lines.length; i++) {
-                    var line = lines[i];
+                    var line = lines[i].replace(/\r$/, ''); // strip \r from \r\n streams
                     if (line.startsWith('event: ')) {
                         currentEvent = line.substring(7).trim();
                     } else if (line.startsWith('data: ')) {

package/src/superlocalmemory/ui/js/ng-entities.js

@@ -16,12 +16,16 @@
   function fetchEntityList(offset) {
     offset = offset || 0;
     fetch('/api/entity/list?limit=' + PAGE_SIZE + '&offset=' + offset)
-      .then(function(r) { return r.json(); })
+      .then(function(r) {
+        if (!r.ok) throw new Error('HTTP ' + r.status);
+        return r.json();
+      })
       .then(function(data) {
         allEntities = data.entities || [];
         renderEntityList(allEntities, data.total || 0, offset);
       })
-      .catch(function() {
+      .catch(function(err) {
+        console.error('[entities] fetchEntityList failed:', err);
         renderEntityList([], 0, 0);
       });
   }

package/src/superlocalmemory/ui/js/ng-mesh.js

@@ -8,56 +8,123 @@
   var REFRESH_INTERVAL = 5000; // 5 seconds
   var refreshTimer = null;
 
+  // ── Install-token bootstrap (mirrors brain.js) ───────────────
+  // Dashboard callers authenticate with the install token so we never
+  // embed the mesh secret in JS. Token is fetched from /internal/token
+  // (loopback-only endpoint) and cached in sessionStorage for the tab session.
+  var TOKEN_STORAGE_KEY = 'slm_install_token';
+
+  function readToken() {
+    try { return window.sessionStorage ? window.sessionStorage.getItem(TOKEN_STORAGE_KEY) : null; }
+    catch (e) { return null; }
+  }
+
+  function writeToken(value) {
+    try { if (window.sessionStorage) window.sessionStorage.setItem(TOKEN_STORAGE_KEY, value); }
+    catch (e) { /* storage disabled */ }
+  }
+
+  function fetchTokenFromServer() {
+    return fetch('/internal/token', { credentials: 'same-origin' })
+      .then(function(r) { return r.ok ? r.json() : null; })
+      .then(function(data) {
+        var tok = data && typeof data.token === 'string' ? data.token.trim() : '';
+        if (tok) { writeToken(tok); return tok; }
+        return null;
+      })
+      .catch(function() { return null; });
+  }
+
+  function ensureToken() {
+    var cached = readToken();
+    if (cached) return Promise.resolve(cached);
+    return fetchTokenFromServer();
+  }
+
+  // Authenticated fetch: injects X-Install-Token; retries once on 401
+  // (token may have been rotated since the tab was opened).
+  function meshFetch(url) {
+    return ensureToken().then(function(token) {
+      var opts = token ? { headers: { 'X-Install-Token': token }, credentials: 'same-origin' } : {};
+      return fetch(url, opts).then(function(r) {
+        if (r.status === 401) {
+          return fetchTokenFromServer().then(function(freshToken) {
+            var retryOpts = freshToken
+              ? { headers: { 'X-Install-Token': freshToken }, credentials: 'same-origin' }
+              : {};
+            return fetch(url, retryOpts);
+          });
+        }
+        return r;
+      });
+    });
+  }
+
+  // ── Public entry point ────────────────────────────────────────
   window.loadMeshPeers = function() {
     fetchMeshStatus();
     fetchMeshPeers();
     fetchMeshEvents();
     fetchMeshState();
 
-    // Auto-refresh while tab is active
+    // Auto-refresh while tab is active; stop when pane loses focus
     clearInterval(refreshTimer);
     refreshTimer = setInterval(function() {
       var pane = document.getElementById('mesh-pane');
       if (pane && pane.classList.contains('active')) {
         fetchMeshStatus();
         fetchMeshPeers();
+        fetchMeshEvents();
+        fetchMeshState();
+      } else {
+        // Pane is no longer active — stop the timer to avoid background polling
+        clearInterval(refreshTimer);
+        refreshTimer = null;
       }
     }, REFRESH_INTERVAL);
   };
 
   // Try BOTH brokers: daemon (port 8765 /mesh/*) AND standalone slm-mesh (port 7899 /*)
-  var STANDALONE_PORT = null; // Discovered from port file or default 7899
+  var STANDALONE_PORT = null;
+
+  function fetchStandaloneBroker(path) {
+    var ports = [7899];
+    return fetch('http://127.0.0.1:' + ports[0] + path, { signal: AbortSignal.timeout(2000) })
+      .then(function(r) {
+        if (r.ok) { STANDALONE_PORT = ports[0]; return r.json(); }
+        STANDALONE_PORT = null;
+        return null;
+      })
+      .catch(function() { STANDALONE_PORT = null; return null; });
+  }
 
   function fetchMeshStatus() {
-    // Try daemon broker first, then standalone
     Promise.all([
-      fetch('/mesh/status').then(function(r) { return r.json(); }).catch(function() { return null; }),
+      meshFetch('/mesh/status').then(function(r) {
+        if (!r.ok) return r.status === 401 ? { _auth_error: true } : null;
+        return r.json();
+      }).catch(function() { return null; }),
       fetchStandaloneBroker('/health')
     ]).then(function(results) {
       var daemon = results[0];
-      var standalone = results[1];
-      renderMeshStatus(daemon, standalone);
+      if (daemon && daemon._auth_error) { renderMeshStatusAuthError(); return; }
+      renderMeshStatus(daemon, results[1]);
     });
   }
 
-  function fetchStandaloneBroker(path) {
-    // Try port file first, then default 7899
-    var ports = [7899];
-    return fetch('http://127.0.0.1:' + ports[0] + path, { signal: AbortSignal.timeout(2000) })
-      .then(function(r) { STANDALONE_PORT = ports[0]; return r.json(); })
-      .catch(function() { return null; });
-  }
-
   function fetchMeshPeers() {
-    // Fetch from BOTH brokers and merge
     Promise.all([
-      fetch('/mesh/peers').then(function(r) { return r.json(); }).catch(function() { return { peers: [] }; }),
+      meshFetch('/mesh/peers').then(function(r) {
+        if (!r.ok) return r.status === 401 ? { _auth_error: true } : { peers: [] };
+        return r.json();
+      }).catch(function() { return { peers: [] }; }),
       fetchStandaloneBroker('/peers')
     ]).then(function(results) {
-      var daemonPeers = (results[0] && results[0].peers) || [];
+      var daemonResult = results[0];
+      if (daemonResult && daemonResult._auth_error) { renderMeshPeersAuthError(); return; }
+      var daemonPeers = (daemonResult && daemonResult.peers) || [];
       var standalonePeers = (results[1] && (results[1].peers || results[1])) || [];
       if (!Array.isArray(standalonePeers)) standalonePeers = [];
-      // Merge, dedup by peer_id
       var seen = {};
       var allPeers = [];
       daemonPeers.concat(standalonePeers).forEach(function(p) {
@@ -66,7 +133,8 @@
       });
       renderMeshPeers(allPeers);
     }).catch(function() {
-      document.getElementById('mesh-peers-list').innerHTML =
+      var el = document.getElementById('mesh-peers-list');
+      if (el) el.innerHTML =
         '<div class="text-center" style="padding:24px;color:var(--ng-text-tertiary)">' +
           '<i class="bi bi-wifi-off" style="font-size:2rem;display:block;margin-bottom:8px"></i>' +
           'Mesh broker not reachable' +
@@ -75,17 +143,51 @@
   }
 
   function fetchMeshEvents() {
-    fetch('/mesh/events').then(function(r) { return r.json(); }).then(function(data) {
+    meshFetch('/mesh/events').then(function(r) {
+      if (!r.ok) return { events: [] };
+      return r.json();
+    }).then(function(data) {
       renderMeshEvents(data.events || data || []);
     }).catch(function() {});
   }
 
   function fetchMeshState() {
-    fetch('/mesh/state').then(function(r) { return r.json(); }).then(function(data) {
+    meshFetch('/mesh/state').then(function(r) {
+      if (!r.ok) return { state: {} };
+      return r.json();
+    }).then(function(data) {
       renderMeshState(data.state || data || {});
     }).catch(function() {});
   }
 
+  // ── Auth-error renderers ──────────────────────────────────────
+  function renderMeshStatusAuthError() {
+    var el = document.getElementById('mesh-status-cards');
+    if (!el) return;
+    el.innerHTML =
+      '<div class="row g-3">' +
+        statusCard('Status', statusDot('error') + ' Auth required', 'bi-lock') +
+        statusCard('Peers', '—', 'bi-people') +
+        statusCard('Uptime', '—', 'bi-clock') +
+        statusCard('Brokers', '—', 'bi-hdd-stack') +
+      '</div>' +
+      '<div style="font-size:0.75rem;color:var(--ng-status-error);margin-top:8px;text-align:center">' +
+        'Mesh endpoints returned 401. The daemon may be starting — retrying automatically.' +
+      '</div>';
+  }
+
+  function renderMeshPeersAuthError() {
+    var el = document.getElementById('mesh-peers-list');
+    if (!el) return;
+    el.innerHTML =
+      '<div class="text-center" style="padding:32px;color:var(--ng-text-tertiary)">' +
+        '<i class="bi bi-lock" style="font-size:2.5rem;display:block;margin-bottom:12px;opacity:0.5"></i>' +
+        '<div style="font-size:0.9375rem;margin-bottom:4px">Authentication required</div>' +
+        '<div style="font-size:0.8125rem">Could not authenticate with the mesh broker. ' +
+        'The dashboard token may still be loading.</div>' +
+      '</div>';
+  }
+
   function renderMeshStatus(daemonData, standaloneData) {
     var el = document.getElementById('mesh-status-cards');
     if (!el) return;

package/src/superlocalmemory/ui/js/optimize.js

@@ -130,13 +130,18 @@
 
   async function _putConfig(body) {
     try {
-      await fetch('/api/optimize/config', {
+      var resp = await fetch('/api/optimize/config', {
         method: 'PUT',
         headers: {'Content-Type': 'application/json'},
         body: JSON.stringify(body)
       });
+      if (!resp.ok) {
+        console.warn('Config update failed: HTTP ' + resp.status);
+        _loadOptimizeConfig(); // revert toggles to server state
+      }
     } catch (e) {
       console.log('Config update error:', e);
+      _loadOptimizeConfig(); // revert toggles to server state
     }
   }
 

package/src/superlocalmemory/ui/js/profiles.js

@@ -210,7 +210,7 @@ async function switchProfile(profileName) {
             showToast('Switched to profile: ' + profileName);
             loadProfiles();
             loadStats();
-            loadGraph();
+            if (typeof loadGraph === 'function') loadGraph();
             loadProfilesTable();
             // v2.7.4: Reload ALL tabs for new profile
             if (typeof loadLearning === 'function') loadLearning();

package/src/superlocalmemory/ui/js/recall-lab.js

@@ -9,7 +9,9 @@ var recallLabState = {
     synthesis: '',
 };
 
-document.getElementById('recall-lab-search')?.addEventListener('click', function() {
+// Delegation handles the case where the recall-lab tab pane is injected after parse time.
+document.addEventListener('click', function(e) {
+    if (!e.target || e.target.id !== 'recall-lab-search') return;
     var query = document.getElementById('recall-lab-query').value.trim();
     if (!query) return;
 
@@ -287,6 +289,10 @@ function buildChannelBar(name, score, max, color) {
     return row;
 }
 
-document.getElementById('recall-lab-query')?.addEventListener('keydown', function(e) {
-    if (e.key === 'Enter') document.getElementById('recall-lab-search')?.click();
+document.addEventListener('keydown', function(e) {
+    if (!e.target || e.target.id !== 'recall-lab-query') return;
+    if (e.key === 'Enter') {
+        var btn = document.getElementById('recall-lab-search');
+        if (btn) btn.click();
+    }
 });

package/src/superlocalmemory/ui/js/timeline.js

@@ -4,9 +4,10 @@
 async function loadTimeline() {
     showLoading('timeline-chart', 'Loading timeline...');
     try {
-        var response = await fetch('/api/timeline?days=30');
+        var response = await fetch('/api/v3/timeline/?range=30d&group_by=date&limit=1000');
+        if (!response.ok) throw new Error('HTTP ' + response.status);
         var data = await response.json();
-        renderTimeline(data.timeline);
+        renderTimeline(data.events || data.timeline);
     } catch (error) {
         console.error('Error loading timeline:', error);
         showEmpty('timeline-chart', 'clock-history', 'Failed to load timeline');

package/src/superlocalmemory.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superlocalmemory
-Version: 3.6.20
+Version: 3.6.22
 Summary: Information-geometric agent memory with mathematical guarantees
 Author-email: Varun Pratap Bhardwaj <admin@superlocalmemory.com>
 License: AGPL-3.0-or-later
@@ -96,10 +96,10 @@ Dynamic: license-file
   <img src="https://superlocalmemory.com/assets/logo-mark.png" alt="SuperLocalMemory" width="200"/>
 </p>
 
-<h1 align="center">SuperLocalMemory V3.6.18</h1>
+<h1 align="center">SuperLocalMemory V3.6.21</h1>
 <p align="center"><strong>Cache. Compress. Remember. Three surfaces — proxy, MCP tools, or skill. Every setup covered.</strong><br/>
 <em>To the best of our knowledge, the only zero-cloud agent memory that beats Mem0's zero-LLM score on LoCoMo. Mode A: 74.8% vs Mem0 64.2% — no GPU, no API key, on CPU.</em></p>
-<p align="center"><code>v3.6.18</code> — <strong>Plugin-native. Profile-aware. Distributed-ready.</strong><br/>
+<p align="center"><code>v3.6.21</code> — <strong>Plugin-native. Profile-aware. Distributed-ready.</strong><br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>3 published research papers</strong> (arXiv preprints + Zenodo-archived) · <a href="https://arxiv.org/abs/2603.02240">arXiv:2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">arXiv:2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">arXiv:2604.04514</a></p>
 
@@ -401,6 +401,8 @@ slm dashboard    # Opens at http://localhost:8765
 
 | Version | Codename | Key Features |
 |---|---|---|
+| **v3.6.21** | Dashboard Audit | Full UI audit across all 7 dashboard tabs — auth fix for mesh panel (issue #60 frontend), Quick Store endpoint, timeline endpoint, r.ok guards, SSE \r fix, event delegation for lazy tabs, optimize toggle revert; backbone.py JSONDecodeError fix (issue #62) |
+| **v3.6.20** | Mesh Auth | Remote mesh auth fix (issue #60) — `_get_broker` now accepts Bearer + X-Mesh-Secret from non-loopback callers; config settings preservation (AIDEV-86) |
 | **v3.6.17** | Community | 8 contributor PRs (observability events, marker-bounded adapter writes, daemon port discovery, anthropic `api_base`, OpenMP workers, atomic-write rehash, `_jl` sentinel, LFS pointer); dashboard-feedback fix (#53/#59); env-tunable SQLite knobs + idle backoff; remote LLM test-probe (#40) |
 | **v3.6.16** | Docs | Corrected Claude Code plugin install — adds the required `/plugin marketplace add` step; clarifies plugin vs pip/npm delivery |
 | **v3.6.15** | Multi-scope | **Opt-in [shared memory](docs/shared-memory.md)** (personal/shared/global, off by default), default-deny scope at every read path, recall scope-race fix, contributor PRs #42/#43/#44, fixes #46–#49 |

package/src/superlocalmemory.egg-info/SOURCES.txt

@@ -505,6 +505,7 @@ tests/test_cli_json.py
 tests/test_cli_v33.py
 tests/test_compliance_full.py
 tests/test_config_system.py
+tests/test_dashboard_preserve_embedding.py
 tests/test_engine_hooks.py
 tests/test_event_bus.py
 tests/test_features.py