superlocalmemory 3.6.22 → 3.7.0

package/src/superlocalmemory/storage/migrations/M018_ingestion_operations.py

@@ -0,0 +1,120 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3
+
+"""M018 — durable canonical-ingestion operation records.
+
+This is the EXPAND phase of the V3.7 ingestion migration.  It is additive:
+legacy ``pending_memories`` and ``ingestion_log`` remain untouched until the
+backfill and dual-write comparison prove the new contract.
+"""
+
+from __future__ import annotations
+
+import sqlite3
+
+NAME = "M018_ingestion_operations"
+DB_TARGET = "memory"
+
+DDL = """
+CREATE TABLE IF NOT EXISTS ingestion_operations (
+    operation_id TEXT PRIMARY KEY,
+    profile_id TEXT NOT NULL,
+    source_type TEXT NOT NULL,
+    idempotency_key TEXT NOT NULL,
+    source_hash TEXT NOT NULL,
+    raw_content TEXT NOT NULL,
+    raw_metadata_json TEXT NOT NULL DEFAULT '{}',
+    scope TEXT NOT NULL DEFAULT 'personal'
+        CHECK (scope IN ('personal', 'project', 'shared', 'global')),
+    shared_with_json TEXT NOT NULL DEFAULT '[]',
+    trusted_actor_id TEXT NOT NULL DEFAULT '',
+    session_id TEXT NOT NULL DEFAULT '',
+    session_date TEXT NOT NULL DEFAULT '',
+    speaker TEXT NOT NULL DEFAULT '',
+    role TEXT NOT NULL DEFAULT 'user',
+    state TEXT NOT NULL DEFAULT 'raw'
+        CHECK (state IN ('raw', 'queryable', 'enriching', 'complete', 'failed')),
+    queryable_fact_ids_json TEXT NOT NULL DEFAULT '[]',
+    final_fact_ids_json TEXT NOT NULL DEFAULT '[]',
+    derivation_version TEXT NOT NULL DEFAULT '',
+    derivation_state_json TEXT NOT NULL DEFAULT '{}',
+    lease_owner TEXT NOT NULL DEFAULT '',
+    lease_expires_at REAL NOT NULL DEFAULT 0,
+    next_retry_at REAL NOT NULL DEFAULT 0,
+    attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+    last_error TEXT NOT NULL DEFAULT '',
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    UNIQUE(profile_id, source_type, idempotency_key)
+);
+CREATE INDEX IF NOT EXISTS idx_ingestion_operations_state
+    ON ingestion_operations(state, updated_at);
+CREATE INDEX IF NOT EXISTS idx_ingestion_operations_source_hash
+    ON ingestion_operations(profile_id, source_hash);
+"""
+
+
+def apply(conn: sqlite3.Connection) -> None:
+    """Create the additive operation table and indexes idempotently."""
+    conn.executescript(DDL)
+    columns = {
+        row[1]
+        for row in conn.execute("PRAGMA table_info(ingestion_operations)").fetchall()
+    }
+    additive_columns = {
+        "derivation_state_json": "TEXT NOT NULL DEFAULT '{}'",
+        "session_date": "TEXT NOT NULL DEFAULT ''",
+        "speaker": "TEXT NOT NULL DEFAULT ''",
+        "role": "TEXT NOT NULL DEFAULT 'user'",
+        "lease_owner": "TEXT NOT NULL DEFAULT ''",
+        "lease_expires_at": "REAL NOT NULL DEFAULT 0",
+        "next_retry_at": "REAL NOT NULL DEFAULT 0",
+    }
+    for name, declaration in additive_columns.items():
+        if name not in columns:
+            conn.execute(
+                f"ALTER TABLE ingestion_operations ADD COLUMN {name} {declaration}"
+            )
+
+
+def verify(conn: sqlite3.Connection) -> bool:
+    """Return true only when the complete M018 contract is present."""
+    table = conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' "
+        "AND name='ingestion_operations'"
+    ).fetchone()
+    if table is None:
+        return False
+    columns = {
+        row[1]
+        for row in conn.execute("PRAGMA table_info(ingestion_operations)").fetchall()
+    }
+    required = {
+        "operation_id",
+        "profile_id",
+        "source_type",
+        "idempotency_key",
+        "source_hash",
+        "raw_content",
+        "state",
+        "queryable_fact_ids_json",
+        "final_fact_ids_json",
+        "derivation_version",
+        "derivation_state_json",
+        "session_date",
+        "speaker",
+        "role",
+        "lease_owner",
+        "lease_expires_at",
+        "next_retry_at",
+        "attempt_count",
+        "last_error",
+    }
+    if not required <= columns:
+        return False
+    indexes = {
+        row[1]
+        for row in conn.execute("PRAGMA index_list(ingestion_operations)").fetchall()
+    }
+    return "idx_ingestion_operations_state" in indexes

package/src/superlocalmemory/storage/migrations/M019_derivation_lineage.py

@@ -0,0 +1,54 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+
+"""M019 — durable, non-fabricated derivation lineage."""
+
+from __future__ import annotations
+
+import sqlite3
+
+NAME = "M019_derivation_lineage"
+DB_TARGET = "memory"
+
+DDL = """
+CREATE TABLE IF NOT EXISTS derivation_lineage (
+    lineage_id TEXT PRIMARY KEY,
+    profile_id TEXT NOT NULL,
+    object_type TEXT NOT NULL,
+    object_id TEXT NOT NULL,
+    operation_id TEXT NOT NULL DEFAULT '',
+    derivation_version TEXT NOT NULL DEFAULT '',
+    source_status TEXT NOT NULL
+        CHECK (source_status IN ('exact', 'derived_from_facts', 'unresolved', 'not_applicable')),
+    source_start INTEGER,
+    source_end INTEGER,
+    source_text_sha256 TEXT NOT NULL DEFAULT '',
+    source_fact_ids_json TEXT NOT NULL DEFAULT '[]',
+    unresolved_reason TEXT NOT NULL DEFAULT '',
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    UNIQUE(profile_id, object_type, object_id, operation_id)
+);
+CREATE INDEX IF NOT EXISTS idx_derivation_lineage_profile
+    ON derivation_lineage(profile_id, object_type, object_id);
+CREATE INDEX IF NOT EXISTS idx_derivation_lineage_operation
+    ON derivation_lineage(operation_id);
+"""
+
+
+def apply(conn: sqlite3.Connection) -> None:
+    conn.executescript(DDL)
+
+
+def verify(conn: sqlite3.Connection) -> bool:
+    table = conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND name='derivation_lineage'"
+    ).fetchone()
+    if table is None:
+        return False
+    columns = {row[1] for row in conn.execute("PRAGMA table_info(derivation_lineage)")}
+    return {
+        "lineage_id", "profile_id", "object_type", "object_id",
+        "operation_id", "derivation_version", "source_status",
+        "source_start", "source_end", "source_text_sha256",
+        "source_fact_ids_json", "unresolved_reason",
+    } <= columns

package/src/superlocalmemory/storage/migrations/M020_model_state_integrity.py

@@ -0,0 +1,52 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+
+"""M020 — forward-only integrity repair for learned model state.
+
+M002's DDL shipped before model-state SHA values were backfilled.  Do not
+modify M002: its stored hash is part of every existing user's upgrade record.
+This migration deterministically fills only missing digests and never changes
+the model payload or ranking metadata.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import sqlite3
+
+NAME = "M020_model_state_integrity"
+DB_TARGET = "learning"
+
+# The runner records a stable fingerprint even though this migration uses a
+# Python apply function for binary-safe SHA computation.
+DDL = "-- M020: backfill missing learning_model_state.bytes_sha256\n"
+
+
+def verify(conn: sqlite3.Connection) -> bool:
+    """Return True only when every persisted model has an integrity digest."""
+    try:
+        missing = conn.execute(
+            "SELECT 1 FROM learning_model_state "
+            "WHERE bytes_sha256 = '' OR bytes_sha256 IS NULL LIMIT 1"
+        ).fetchone()
+    except sqlite3.Error:
+        return False
+    return missing is None
+
+
+def apply(conn: sqlite3.Connection) -> None:
+    """Backfill SHA-256 values without modifying model bytes or metadata."""
+    rows = conn.execute(
+        "SELECT id, state_bytes FROM learning_model_state "
+        "WHERE bytes_sha256 = '' OR bytes_sha256 IS NULL"
+    ).fetchall()
+    updates = [
+        (hashlib.sha256(state_bytes).hexdigest(), row_id)
+        for row_id, state_bytes in rows
+        if state_bytes is not None
+    ]
+    if updates:
+        conn.executemany(
+            "UPDATE learning_model_state SET bytes_sha256 = ? WHERE id = ?",
+            updates,
+        )

package/src/superlocalmemory/storage/migrations/__init__.py

@@ -24,6 +24,8 @@ from . import (
     M004_cross_platform_sync_log,
     M005_bandit_tables,
     M015_add_pinned_column,
+    M019_derivation_lineage,
+    M020_model_state_integrity,
 )
 
 # ---------------------------------------------------------------------------
@@ -72,6 +74,9 @@ __all__ = (
     "M003_migration_log",
     "M004_cross_platform_sync_log",
     "M005_bandit_tables",
+    "M015_add_pinned_column",
+    "M019_derivation_lineage",
+    "M020_model_state_integrity",
     # Legacy re-exports (backward compat):
     "CURRENT_SCHEMA_VERSION",
     "get_schema_version",

package/src/superlocalmemory/storage/models.py

@@ -402,6 +402,12 @@ class RetrievalResult:
     score: float = 0.0
     channel_scores: dict[str, float] = field(default_factory=dict)
     confidence: float = 0.0
+    # Score Contract v2. Legacy ``score`` and ``confidence`` remain one-release
+    # aliases of relevance_score and memory_confidence respectively.
+    relevance_score: float | None = None
+    ranking_score: float | None = None
+    memory_confidence: float | None = None
+    rank_position: int = 0
     evidence_chain: list[str] = field(default_factory=list)
     trust_score: float = 0.5
     # LLD-00 §3 + P0.4: HMAC marker emitted during recall so post-tool hooks
@@ -424,3 +430,13 @@ class RecallResponse:
     # v3.6.6: Evidence floor. True when floor gates out ALL results.
     # Additive field — backward compatible (defaults to False).
     no_confident_match: bool = False
+    score_contract_version: str = "2"
+    calibration_status: str = "uncalibrated"
+    calibration_id: str | None = None
+    answer_confidence: float | None = None
+    abstained: bool = False
+    abstention_reason: str | None = None
+    # Cross-encoder execution is observable; cold/busy/error fallback must not
+    # be mistaken for a reranked response.
+    reranker_applied: bool = False
+    reranker_status: str = "not_configured"

package/src/superlocalmemory/storage/quantized_store.py

@@ -12,7 +12,7 @@ HR-06: BLOB columns use Python bytes, not base64.
 HR-07: QJL is optional -- system works without it.
 
 Part of Qualixar | Author: Varun Pratap Bhardwaj
-License: Elastic-2.0
+License: AGPL-3.0-or-later
 """
 
 from __future__ import annotations
@@ -150,13 +150,29 @@ class QuantizedEmbeddingStore:
         query_embedding: NDArray,
         profile_id: str,
         top_k: int = 50,
+        *,
+        bit_widths: tuple[int, ...] | None = None,
     ) -> list[tuple[str, float]]:
         """Search polar embeddings for a profile.
 
         Pre-filters by lifecycle_zone (excludes 'forgotten').
+        ``bit_widths`` selects a persisted precision tier; ``None`` preserves
+        the legacy all-quantized-row behavior.
         Returns [(fact_id, similarity)] sorted descending.
         """
+        if bit_widths is not None and not bit_widths:
+            return []
         try:
+            width_clause = ""
+            params: list[object] = [profile_id]
+            if bit_widths is not None:
+                widths = tuple(int(width) for width in bit_widths)
+                width_clause = (
+                    " AND pe.bit_width IN ("
+                    + ",".join("?" for _ in widths)
+                    + ")"
+                )
+                params.extend(widths)
             rows = self._db.execute(
                 "SELECT pe.fact_id, pe.radius, pe.angle_indices, "
                 "  pe.qjl_bits, pe.bit_width "
@@ -164,8 +180,9 @@ class QuantizedEmbeddingStore:
                 "JOIN fact_retention fr "
                 "  ON pe.fact_id = fr.fact_id AND fr.profile_id = pe.profile_id "
                 "WHERE pe.profile_id = ? "
-                "  AND fr.lifecycle_zone NOT IN ('forgotten')",
-                (profile_id,),
+                "  AND fr.lifecycle_zone NOT IN ('forgotten')"
+                + width_clause,
+                tuple(params),
             )
         except Exception as exc:
             logger.error("search query failed: %s", exc)

package/src/superlocalmemory/storage/v2_migrator.py

@@ -17,10 +17,12 @@ import sys
 from datetime import datetime, UTC
 from pathlib import Path
 
+from superlocalmemory.infra.data_root import DynamicStatePath, canonical_data_root
+
 logger = logging.getLogger(__name__)
 
 V2_BASE = Path.home() / ".claude-memory"
-V3_BASE = Path.home() / ".superlocalmemory"
+V3_BASE = DynamicStatePath()
 V2_DB_NAME = "memory.db"
 BACKUP_NAME = "memory-v2-backup.db"
 
@@ -143,10 +145,10 @@ V3_INDEXES_SQL = [
 class V2Migrator:
     """Migrate V2 database to V3 schema."""
 
-    def __init__(self, home: Path | None = None):
+    def __init__(self, home: Path | None = None, v3_base: Path | None = None):
         self._home = home or Path.home()
         self._v2_base = self._home / ".claude-memory"
-        self._v3_base = self._home / ".superlocalmemory"
+        self._v3_base = Path(v3_base) if v3_base is not None else canonical_data_root()
         self._v2_db = self._v2_base / V2_DB_NAME
         self._v3_db = self._v3_base / V2_DB_NAME
         self._backup_db = self._v3_base / BACKUP_NAME

package/src/superlocalmemory/ui/favicon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="14" fill="#0a0e1a"/>
+  <path d="M16 32h12l8-14 12 14" fill="none" stroke="#45e0a8" stroke-linecap="round" stroke-linejoin="round" stroke-width="5"/>
+  <circle cx="16" cy="32" r="5" fill="#45e0a8"/><circle cx="36" cy="18" r="5" fill="#45e0a8"/><circle cx="48" cy="32" r="5" fill="#45e0a8"/>
+</svg>

package/src/superlocalmemory/ui/index.html

@@ -8,6 +8,7 @@
          on mismatch, so the browser cannot show stale UI after an upgrade. -->
     <meta name="slm-version" content="__SLM_VERSION__">
     <title>SuperLocalMemory V3 — Dashboard</title>
+    <link rel="icon" type="image/svg+xml" href="static/favicon.svg">
 
     <!-- Bootstrap CSS (vendored locally v3.4.21 — no CDN calls, works offline) -->
     <link href="static/vendor/bootstrap.min.css" rel="stylesheet">

package/src/superlocalmemory/ui/js/compliance.js

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Elastic-2.0
+// SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (c) 2026 SuperLocalMemory (superlocalmemory.com)
 // Compliance tab — audit trail, retention policies, ABAC (v2.8)
 // NOTE: All dynamic values use textContent or escapeHtml() from core.js before DOM insertion.

package/src/superlocalmemory/ui/js/core.js

@@ -14,6 +14,23 @@
 // ============================================================================
 
 window.SLM_FETCH_TIMEOUT_MS = 15000;
+window.SLM_INSTALL_TOKEN_KEY = 'slm_install_token';
+
+window.slmInstallToken = async function (forceRefresh) {
+    if (!forceRefresh) {
+        var cached = sessionStorage.getItem(window.SLM_INSTALL_TOKEN_KEY);
+        if (cached) return cached;
+    }
+    var response = await window.__slmOriginalFetch(
+        '/internal/token',
+        {credentials: 'same-origin'}
+    );
+    if (!response.ok) return '';
+    var payload = await response.json();
+    var token = payload && payload.token ? payload.token : '';
+    if (token) sessionStorage.setItem(window.SLM_INSTALL_TOKEN_KEY, token);
+    return token;
+};
 
 // Global fetch patch: apply the abort timeout to every relative-URL request
 // automatically. 17 UI modules call bare fetch() — patching here avoids
@@ -26,18 +43,42 @@ window.SLM_FETCH_TIMEOUT_MS = 15000;
     if (window.__slmFetchPatched) return;
     window.__slmFetchPatched = true;
     var _origFetch = window.fetch.bind(window);
+    window.__slmOriginalFetch = _origFetch;
     window.fetch = function (input, init) {
-        init = init || {};
+        init = Object.assign({}, init || {});
         var urlStr = typeof input === 'string' ? input : (input && input.url) || '';
         var isRelative = !(/^https?:\/\//i.test(urlStr));
-        if (!isRelative || init.signal) {
-            return _origFetch(input, init);
+        var method = String(
+            init.method || (input && input.method) || 'GET'
+        ).toUpperCase();
+        var mutating = ['POST', 'PUT', 'PATCH', 'DELETE'].indexOf(method) !== -1;
+
+        function send() {
+            if (!isRelative || init.signal) {
+                return _origFetch(input, init);
+            }
+            var controller = new AbortController();
+            var timeoutMs = init.timeoutMs || window.SLM_FETCH_TIMEOUT_MS;
+            var timer = setTimeout(function () { controller.abort(); }, timeoutMs);
+            init.signal = controller.signal;
+            return _origFetch(input, init).finally(function () { clearTimeout(timer); });
+        }
+
+        if (isRelative && mutating && urlStr !== '/internal/token') {
+            return window.slmInstallToken(false).then(function (token) {
+                if (!token) throw new Error('local write credential unavailable');
+                var headers = new Headers(
+                    init.headers || (input && input.headers) || {}
+                );
+                if (!headers.has('X-Install-Token')) {
+                    headers.set('X-Install-Token', token);
+                }
+                init.headers = headers;
+                init.credentials = init.credentials || 'same-origin';
+                return send();
+            });
         }
-        var controller = new AbortController();
-        var timeoutMs = init.timeoutMs || window.SLM_FETCH_TIMEOUT_MS;
-        var timer = setTimeout(function () { controller.abort(); }, timeoutMs);
-        init.signal = controller.signal;
-        return _origFetch(input, init).finally(function () { clearTimeout(timer); });
+        return send();
     };
 })();
 

package/src/superlocalmemory/ui/js/dashboard.js

@@ -72,14 +72,35 @@ document.addEventListener('click', function(e) {
     }
 });
 
+async function dashboardInstallToken() {
+    var key = 'slm_install_token';
+    var cached = sessionStorage.getItem(key);
+    if (cached) return cached;
+    var response = await fetch('/internal/token', {credentials: 'same-origin'});
+    if (!response.ok) return '';
+    var payload = await response.json();
+    var token = payload && payload.token ? payload.token : '';
+    if (token) sessionStorage.setItem(key, token);
+    return token;
+}
+
 // Quick store
-document.getElementById('quick-store-btn')?.addEventListener('click', function() {
+document.getElementById('quick-store-btn')?.addEventListener('click', async function() {
     var input = document.getElementById('quick-store-input');
     var content = input.value.trim();
     if (!content) return;
+    var token = await dashboardInstallToken();
+    if (!token) {
+        showToast('Store failed: local write credential unavailable', 'error');
+        return;
+    }
     fetch('/remember', {
         method: 'POST',
-        headers: {'Content-Type': 'application/json'},
+        credentials: 'same-origin',
+        headers: {
+            'Content-Type': 'application/json',
+            'X-Install-Token': token
+        },
         body: JSON.stringify({content: content})
     }).then(function(r) {
         if (!r.ok) return r.json().catch(function() { return {}; }).then(function(d) {

package/src/superlocalmemory/ui/js/feedback.js

@@ -1,7 +1,7 @@
 /**
  * SuperLocalMemory V2 - Feedback Module (v2.7.4)
  * Copyright (c) 2026 Varun Pratap Bhardwaj
- * Licensed under Elastic License 2.0
+ * Licensed under GNU Affero General Public License v3.0 or later
  *
  * Collects implicit and explicit feedback signals from dashboard
  * interactions. All data stays 100% local.

package/src/superlocalmemory/ui/js/graph-filters.js

@@ -1,5 +1,5 @@
 // SuperLocalMemory V2.6.5 - Interactive Knowledge Graph - Filtering Module
-// Copyright (c) 2026 Varun Pratap Bhardwaj — Elastic License 2.0
+// Copyright (c) 2026 Varun Pratap Bhardwaj — GNU Affero General Public License v3.0 or later
 // Part of modular graph visualization system (split from monolithic graph-cytoscape.js)
 
 // ============================================================================

package/src/superlocalmemory/ui/js/graph-ui.js

@@ -1,5 +1,5 @@
 // SuperLocalMemory V2.6.5 - Interactive Knowledge Graph - UI Elements Module
-// Copyright (c) 2026 Varun Pratap Bhardwaj — Elastic License 2.0
+// Copyright (c) 2026 Varun Pratap Bhardwaj — GNU Affero General Public License v3.0 or later
 // Part of modular graph visualization system (split from monolithic graph-cytoscape.js)
 
 // ============================================================================

package/src/superlocalmemory/ui/js/lifecycle.js

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Elastic-2.0
+// SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (c) 2026 SuperLocalMemory (superlocalmemory.com)
 // Lifecycle tab — state distribution, compaction, transitions (v2.8)
 // NOTE: All dynamic values pass through escapeHtml() or textContent for DOM insertion.

package/src/superlocalmemory/ui/js/ng-mesh.js

@@ -84,50 +84,26 @@
     }, REFRESH_INTERVAL);
   };
 
-  // Try BOTH brokers: daemon (port 8765 /mesh/*) AND standalone slm-mesh (port 7899 /*)
-  var STANDALONE_PORT = null;
-
-  function fetchStandaloneBroker(path) {
-    var ports = [7899];
-    return fetch('http://127.0.0.1:' + ports[0] + path, { signal: AbortSignal.timeout(2000) })
-      .then(function(r) {
-        if (r.ok) { STANDALONE_PORT = ports[0]; return r.json(); }
-        STANDALONE_PORT = null;
-        return null;
-      })
-      .catch(function() { STANDALONE_PORT = null; return null; });
-  }
-
   function fetchMeshStatus() {
-    Promise.all([
-      meshFetch('/mesh/status').then(function(r) {
-        if (!r.ok) return r.status === 401 ? { _auth_error: true } : null;
-        return r.json();
-      }).catch(function() { return null; }),
-      fetchStandaloneBroker('/health')
-    ]).then(function(results) {
-      var daemon = results[0];
+    meshFetch('/mesh/status').then(function(r) {
+      if (!r.ok) return r.status === 401 ? { _auth_error: true } : null;
+      return r.json();
+    }).catch(function() { return null; }).then(function(daemon) {
       if (daemon && daemon._auth_error) { renderMeshStatusAuthError(); return; }
-      renderMeshStatus(daemon, results[1]);
+      renderMeshStatus(daemon, null);
     });
   }
 
   function fetchMeshPeers() {
-    Promise.all([
-      meshFetch('/mesh/peers').then(function(r) {
-        if (!r.ok) return r.status === 401 ? { _auth_error: true } : { peers: [] };
-        return r.json();
-      }).catch(function() { return { peers: [] }; }),
-      fetchStandaloneBroker('/peers')
-    ]).then(function(results) {
-      var daemonResult = results[0];
+    meshFetch('/mesh/peers').then(function(r) {
+      if (!r.ok) return r.status === 401 ? { _auth_error: true } : { peers: [] };
+      return r.json();
+    }).catch(function() { return { peers: [] }; }).then(function(daemonResult) {
       if (daemonResult && daemonResult._auth_error) { renderMeshPeersAuthError(); return; }
       var daemonPeers = (daemonResult && daemonResult.peers) || [];
-      var standalonePeers = (results[1] && (results[1].peers || results[1])) || [];
-      if (!Array.isArray(standalonePeers)) standalonePeers = [];
       var seen = {};
       var allPeers = [];
-      daemonPeers.concat(standalonePeers).forEach(function(p) {
+      daemonPeers.forEach(function(p) {
         var id = p.peer_id || p.id || JSON.stringify(p);
         if (!seen[id]) { seen[id] = true; allPeers.push(p); }
       });
@@ -200,28 +176,18 @@
     // Standalone broker (TypeScript, slm-mesh npm)
     var standaloneUp = standaloneData && standaloneData.status === 'ok';
     var standaloneUptime = standaloneData ? (standaloneData.uptime || 0) : 0;
-    var standaloneVersion = standaloneData ? (standaloneData.version || '') : '';
-
-    var anyUp = daemonUp || standaloneUp;
-    var statusText = anyUp ? 'Active' : 'Offline';
-    var statusKey = anyUp ? 'active' : 'dead';
-    var bestUptime = Math.max(daemonUptime, standaloneUptime);
-
-    // Combined info
-    var brokerInfo = [];
-    if (daemonUp) brokerInfo.push('Daemon (Python)');
-    if (standaloneUp) brokerInfo.push('slm-mesh ' + standaloneVersion);
+    var statusText = daemonUp ? 'Active' : 'Offline';
+    var statusKey = daemonUp ? 'active' : 'dead';
 
     el.innerHTML =
       '<div class="row g-3">' +
         statusCard('Broker', statusDot(statusKey) + ' ' + statusText, 'bi-wifi') +
         statusCard('Peers', daemonPeers, 'bi-people') +
-        statusCard('Uptime', formatUptime(bestUptime), 'bi-clock') +
-        statusCard('Brokers', brokerInfo.length, 'bi-hdd-stack') +
+        statusCard('Uptime', formatUptime(daemonUptime), 'bi-clock') +
+        statusCard('Broker', daemonUp ? 1 : 0, 'bi-hdd-stack') +
       '</div>' +
       '<div style="font-size:0.75rem;color:var(--ng-text-quaternary);margin-top:8px;text-align:center">' +
-        (brokerInfo.length > 0 ? 'Running: ' + brokerInfo.join(' + ') : 'No brokers detected') +
-        (standaloneUp ? ' (port 7899)' : '') +
+        (daemonUp ? 'Running: integrated SLM daemon' : 'No broker detected') +
         ' · Peers register via <code>mesh_summary</code> MCP tool and expire after 60s without heartbeat' +
       '</div>';
   }

package/src/superlocalmemory/ui/js/settings.js

@@ -272,12 +272,14 @@ function _updateSidebarWidget(destinations) {
 
     if (primary.destination_type === 'google_drive') {
         var email = config.email || 'Google Drive';
-        avatar.innerHTML = '<img src="https://www.google.com/s2/favicons?domain=google.com&sz=32" style="width:28px;height:28px;border-radius:50%;" onerror="this.outerHTML=\'<i class=\\\'bi bi-google\\\' style=\\\'font-size:14px;color:#4285f4;\\\'></i>\'">';
+        // Keep the dashboard fully local. CSP deliberately forbids remote
+        // avatar requests, and a provider icon conveys the same state.
+        avatar.innerHTML = '<i class="bi bi-google" style="font-size:14px;color:#4285f4;"></i>';
         name.textContent = email.split('@')[0];
         name.title = email;
     } else if (primary.destination_type === 'github') {
         var username = config.username || 'GitHub';
-        avatar.innerHTML = '<img src="https://github.com/' + username + '.png?size=56" style="width:28px;height:28px;border-radius:50%;" onerror="this.outerHTML=\'<i class=\\\'bi bi-github\\\' style=\\\'font-size:14px;\\\'></i>\'">';
+        avatar.innerHTML = '<i class="bi bi-github" style="font-size:14px;"></i>';
         name.textContent = username;
     }