superlocalmemory 3.7.7 → 3.8.0

package/src/superlocalmemory/ui/js/event-delegation.js

@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+// B2 (3.7.9): CSP-safe event delegation. Replaces inline on*= handlers
+// (which force script-src 'unsafe-inline') with data-act-* attributes
+// dispatched by document-level listeners. Registry keys are an allowlist
+// by construction — no reflective window[name] invocation.
+(function () {
+  'use strict';
+
+  // action-key -> handler(el, event). Handlers call existing globals.
+  const ACTIONS = {
+    // --- bespoke ---
+    'scroll-into': (el) => { const t = document.getElementById(el.dataset.target); if (t) t.scrollIntoView({ behavior: 'smooth', block: 'start' }); },
+    'sigma-clear-search': () => { sigmaClearSearch(); const i = document.getElementById('sigma-search-input'); if (i) i.value = ''; },
+    'export-all': (el, e) => { if (e) e.preventDefault(); exportAll(el.dataset.format); },
+    'export-search-results': (el, e) => { if (e) e.preventDefault(); exportSearchResults(); },
+    'set-memory-filter': (el) => setMemoryFilter(el.dataset.filter),
+    'community-source': (el) => handleCommunitySourceToggle(el.dataset.source),
+    // --- value (this.value) ---
+    'handle-resolution-change': (el) => handleResolutionChange(el.value),
+    'sigma-filter-by-category': (el) => sigmaFilterByCategory(el.value),
+    'sigma-search': (el) => sigmaSearch(el.value),
+    // --- no-arg ---
+    'backup-learning-db': () => backupLearningDb(),
+    'clear-event-stream': () => clearEventStream(),
+    'compact-dry-run': () => compactDryRun(),
+    'compact-execute': () => compactExecute(),
+    'connect-git-hub': () => connectGitHub(),
+    'connect-google-drive': () => connectGoogleDrive(),
+    'copy-memory-to-clipboard': () => copyMemoryToClipboard(),
+    'create-backup-now': () => createBackupNow(),
+    'create-profile': () => createProfile(),
+    'create-retention-policy': () => createRetentionPolicy(),
+    'evaluate-tiers-now': () => evaluateTiersNow(),
+    'export-backup': () => exportBackup(),
+    'export-memory-as-markdown': () => exportMemoryAsMarkdown(),
+    'filter-events': () => filterEvents(),
+    'load-agents': () => loadAgents(),
+    'load-clusters': () => loadClusters(),
+    'load-compliance': () => loadCompliance(),
+    'load-entity-explorer': () => loadEntityExplorer(),
+    'load-graph': () => loadGraph(),
+    'load-health-monitor': () => loadHealthMonitor(),
+    'load-ingestion-status': () => loadIngestionStatus(),
+    'load-mesh-peers': () => loadMeshPeers(),
+    'load-skill-evolution': () => loadSkillEvolution(),
+    'refresh-dashboard': () => refreshDashboard(),
+    'reset-learning-data': () => resetLearningData(),
+    'run-community-detection': () => runCommunityDetection(),
+    'save-backup-config': () => saveBackupConfig(),
+    'search-memories': () => searchMemories(),
+    'sigma-reset-view': () => sigmaResetView(),
+    'sigma-zoom-in': () => sigmaZoomIn(),
+    'sigma-zoom-out': () => sigmaZoomOut(),
+    'sync-cloud-now': () => syncCloudNow(),
+    'toggle-dark-mode': () => toggleDarkMode(),
+    // --- phase 2: handlers on JS-generated markup (dynamic args via data-*) ---
+    'toggle-privacy-blur': () => togglePrivacyBlur(),
+    'open-settings-tab': () => { const t = document.querySelector('[data-target=settings]'); if (t) t.click(); },
+    'show-chat-panel': () => showChatPanel(),
+    'show-detail-panel': () => showDetailPanel(),
+    'send-chat-from-input': () => sendChatFromInput(),
+    'cancel-chat': () => cancelChat(),
+    'send-chat-query': (el) => sendChatQuery(el.dataset.query),
+    'chat-submit-on-enter': (el, e) => { if (e && e.key === 'Enter') sendChatFromInput(); },
+    'citation-click': (el, e) => { if (e) e.preventDefault(); _onCitationClick(el.dataset.factId); },
+    'filter-entities': (el) => filterEntities(el.value),
+    'navigate-entity-page': (el) => navigateEntityPage(parseInt(el.dataset.page, 10)),
+    'show-entity-detail': (el) => showEntityDetail(el.dataset.entity),
+    'recompile-entity': (el) => recompileEntity(el.dataset.entity),
+    'close-entity-detail': () => { const p = document.getElementById('entity-detail-panel'); if (p) p.style.display = 'none'; },
+    'trigger-evolution': () => triggerEvolution(),
+    'enable-evolution': () => enableEvolution(),
+    'save-evolution-config': () => saveEvolutionConfig(),
+    'sigma-highlight-node': (el) => sigmaHighlightNode(el.dataset.nodeId),
+    'open-memory-detail': (el) => openMemoryDetail({ id: el.dataset.memId, content: el.dataset.memContent, category: el.dataset.memCategory, importance: parseFloat(el.dataset.memImportance) }, 'graph'),
+    'sigma-filter-community': (el) => sigmaFilterByCommunity(parseInt(el.dataset.communityId, 10), el.dataset.communitySrc),
+    'odg-select': (el) => odgSelect(el.dataset.odgId),  // od-graph.js node inspector + citation clicks
+    'load-memories-page': (el) => loadMemories(parseInt(el.dataset.page, 10)),
+    'disconnect-destination': (el) => disconnectDestination(el.dataset.destId),
+    'adapter-action': (el) => adapterAction(el.dataset.adapter, el.dataset.adapterAction),
+  };
+
+  const ATTR = { click: 'actClick', change: 'actChange', input: 'actInput', keydown: 'actKeydown' };
+
+  function makeHandler(type) {
+    const key = ATTR[type];
+    return function (event) {
+      let el = event.target;
+      while (el && el.nodeType === 1) {
+        if (el.dataset && el.dataset[key]) {
+          const fn = ACTIONS[el.dataset[key]];
+          if (typeof fn === 'function') fn(el, event);
+          return;
+        }
+        el = el.parentElement;
+      }
+    };
+  }
+
+  ['click', 'change', 'input', 'keydown'].forEach((t) => document.addEventListener(t, makeHandler(t)));
+})();

package/src/superlocalmemory/ui/js/knowledge-graph.js

@@ -457,7 +457,7 @@ function openSigmaNodeDetail(nodeId) {
         var neighbors = sigmaGraph.neighbors(nodeId);
         var neighborList = neighbors.slice(0, 10).map(function(nid) {
             var na = sigmaGraph.getNodeAttributes(nid);
-            return '<div class="border-bottom py-1 cursor-pointer" onclick="sigmaHighlightNode(\'' + nid + '\')">'
+            return '<div class="border-bottom py-1 cursor-pointer" data-act-click="sigma-highlight-node" data-node-id="' + nid + '">'
                 + '<small class="text-primary">' + escapeHtml((na.label || '').substring(0, 40)) + '</small>'
                 + '</div>';
         }).join('');
@@ -477,7 +477,7 @@ function openSigmaNodeDetail(nodeId) {
             + '<h6 class="mb-1">Connected (' + neighbors.length + ')</h6>'
             + '<div style="max-height:250px;overflow-y:auto;">' + (neighborList || '<span class="text-muted">No connections</span>') + '</div>'
             + '<hr class="my-2">'
-            + '<button class="btn btn-sm btn-outline-primary w-100" onclick="openMemoryDetail({id:\'' + nodeId + '\',content:\'' + escapeHtml((attrs.slm_content || '').substring(0, 80).replace(/'/g, "\\'")) + '\',category:\'' + (attrs.slm_category || '') + '\',importance:' + (attrs.slm_importance || 0.5) + '},\'graph\')"><i class="bi bi-box-arrow-up-right"></i> Full Detail</button>';
+            + '<button class="btn btn-sm btn-outline-primary w-100" data-act-click="open-memory-detail" data-mem-id="' + nodeId + '" data-mem-content="' + escapeHtml((attrs.slm_content || '').substring(0, 80)).replace(/"/g, '&quot;') + '" data-mem-category="' + (attrs.slm_category || '') + '" data-mem-importance="' + (attrs.slm_importance || 0.5) + '"><i class="bi bi-box-arrow-up-right"></i> Full Detail</button>';
     }
 }
 
@@ -493,7 +493,7 @@ function updateSigmaStatsPanel(data) {
         categories[cat] = (categories[cat] || 0) + 1;
     });
     var catHtml = Object.keys(categories).map(function(k) {
-        return '<div>' + k + ': <strong>' + categories[k] + '</strong></div>';
+        return '<div>' + escapeHtml(k) + ': <strong>' + categories[k] + '</strong></div>';
     }).join('');
     panel.innerHTML = '<div>Nodes: <strong>' + nodes.length + '</strong></div>'
         + '<div>Edges: <strong>' + links.length + '</strong></div>'
@@ -738,14 +738,14 @@ function renderLiveCommunityPanel(communityMap) {
         // Generate simple label from most common entity
         var label = generateLiveLabel(c.community_id, c.members);
         html += '<div class="d-flex align-items-center mb-1 cursor-pointer" '
-            + 'onclick="sigmaFilterByCommunity(' + c.community_id + ', \'' + communitySource + '\')" '
+            + 'data-act-click="sigma-filter-community" data-community-id="' + c.community_id + '" data-community-src="' + communitySource + '" '
             + 'title="' + c.members.length + ' memories">'
             + '<span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:' + color + ';flex-shrink:0;"></span>'
             + '<span class="ms-1 text-truncate" style="font-size:0.75rem;">' + escapeHtml(label) + '</span>'
             + '<span class="badge bg-light text-dark ms-auto" style="font-size:0.65rem;">' + c.members.length + '</span>'
             + '</div>';
     });
-    html += '<button class="btn btn-sm btn-outline-secondary w-100 mt-1" onclick="sigmaClearSearch()">'
+    html += '<button class="btn btn-sm btn-outline-secondary w-100 mt-1" data-act-click="sigma-clear-search">'
         + '<i class="bi bi-x-circle"></i> Clear Filter</button>';
     panel.innerHTML = html;
 }
@@ -780,7 +780,7 @@ function loadCommunities() {
             var communities = data.communities || [];
             if (communities.length === 0) {
                 panel.innerHTML = '<div class="text-muted small">No communities detected yet.</div>'
-                    + '<button class="btn btn-sm btn-outline-primary w-100 mt-1" onclick="runCommunityDetection()">'
+                    + '<button class="btn btn-sm btn-outline-primary w-100 mt-1" data-act-click="run-community-detection">'
                     + '<i class="bi bi-cpu"></i> Detect Communities</button>';
                 return;
             }
@@ -789,16 +789,16 @@ function loadCommunities() {
             communities.forEach(function(c) {
                 var color = c.color || SIGMA_CLUSTER_COLORS[c.community_id % SIGMA_CLUSTER_COLORS.length];
                 html += '<div class="d-flex align-items-center mb-1 cursor-pointer" '
-                    + 'onclick="sigmaFilterByCommunity(' + c.community_id + ', \'backend\')" '
-                    + 'title="' + (c.top_entities || []).join(', ') + '">'
+                    + 'data-act-click="sigma-filter-community" data-community-id="' + c.community_id + '" data-community-src="backend" '
+                    + 'title="' + escapeHtml((c.top_entities || []).join(', ')) + '">'
                     + '<span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:' + color + ';flex-shrink:0;"></span>'
                     + '<span class="ms-1 text-truncate" style="font-size:0.75rem;">' + escapeHtml(c.label) + '</span>'
                     + '<span class="badge bg-light text-dark ms-auto" style="font-size:0.65rem;">' + c.member_count + '</span>'
                     + '</div>';
             });
-            html += '<button class="btn btn-sm btn-outline-secondary w-100 mt-1" onclick="sigmaClearSearch()">'
+            html += '<button class="btn btn-sm btn-outline-secondary w-100 mt-1" data-act-click="sigma-clear-search">'
                 + '<i class="bi bi-x-circle"></i> Clear Filter</button>';
-            html += '<button class="btn btn-sm btn-outline-primary w-100 mt-1" onclick="runCommunityDetection()">'
+            html += '<button class="btn btn-sm btn-outline-primary w-100 mt-1" data-act-click="run-community-detection">'
                 + '<i class="bi bi-arrow-clockwise"></i> Refresh</button>';
             panel.innerHTML = html;
         })
@@ -816,7 +816,7 @@ function runCommunityDetection() {
                 loadCommunities();
                 loadGraphSigma();
             } else {
-                if (panel) panel.innerHTML = '<div class="text-danger small">Failed: ' + (data.error || 'Unknown') + '</div>';
+                if (panel) panel.innerHTML = '<div class="text-danger small">Failed: ' + escapeHtml(data.error || 'Unknown') + '</div>';
             }
         })
         .catch(function(e) {

package/src/superlocalmemory/ui/js/math-health.js

@@ -1,5 +1,5 @@
 // SuperLocalMemory V3 — Math Health
-// Displays status of Fisher-Rao, sheaf cohomology, and Langevin dynamics layers.
+// Displays status of the mathematical scoring, consistency, and lifecycle layers.
 
 async function loadMathHealth() {
     var CID = 'math-health-cards';

package/src/superlocalmemory/ui/js/memories.js

@@ -27,8 +27,13 @@ var _slmLastTotal = 0;
 
 async function loadMemories(page) {
     if (typeof page === 'number') _slmPage = Math.max(0, page);
-    var category = document.getElementById('filter-category').value;
-    var project = document.getElementById('filter-project').value;
+    // OD dashboard renders memories via odRenderMemories; the legacy
+    // #filter-category / #filter-project selects may be absent. Null-guard so
+    // this legacy loader never throws on the OD panes.
+    var _catEl = document.getElementById('filter-category');
+    var _projEl = document.getElementById('filter-project');
+    var category = _catEl ? _catEl.value : '';
+    var project = _projEl ? _projEl.value : '';
     var limit = _slmPageSize;
     var offset = _slmPage * limit;
     var url = '/api/memories?limit=' + limit + '&offset=' + offset;
@@ -70,9 +75,9 @@ function renderPaginationControls(data) {
         '<div class="d-flex justify-content-between align-items-center mt-3 small">' +
           '<span class="text-muted">Showing ' + firstIdx + '\u2013' + showing + ' of ' + total + ' memories</span>' +
           '<div class="btn-group btn-group-sm">' +
-            '<button type="button" class="btn btn-outline-secondary" ' + prevDisabled + ' onclick="loadMemories(' + (_slmPage - 1) + ')"><i class="bi bi-chevron-left"></i> Prev</button>' +
+            '<button type="button" class="btn btn-outline-secondary" ' + prevDisabled + ' data-act-click="load-memories-page" data-page="' + (_slmPage - 1) + '"><i class="bi bi-chevron-left"></i> Prev</button>' +
             '<button type="button" class="btn btn-outline-secondary disabled">Page ' + (_slmPage + 1) + ' / ' + (lastPage + 1) + '</button>' +
-            '<button type="button" class="btn btn-outline-secondary" ' + nextDisabled + ' onclick="loadMemories(' + (_slmPage + 1) + ')">Next <i class="bi bi-chevron-right"></i></button>' +
+            '<button type="button" class="btn btn-outline-secondary" ' + nextDisabled + ' data-act-click="load-memories-page" data-page="' + (_slmPage + 1) + '">Next <i class="bi bi-chevron-right"></i></button>' +
           '</div>' +
         '</div>';
 }
@@ -85,6 +90,12 @@ function renderMemoriesTable(memories, showScores) {
     }
 
     window._slmMemories = memories;
+    // OD dashboard renders memories via odRenderMemories; the legacy
+    // #memories-list table is absent on those panes. The cache above is set
+    // for OD features that read window._slmMemories, but skip the legacy DOM
+    // render here so this loader never throws on OD panes (mirrors the
+    // #filter-category / #filter-project null-guards in loadMemories).
+    if (!container) return;
     var scoreHeader = showScores ? '<th>Score</th>' : '';
 
     var rows = '';

package/src/superlocalmemory/ui/js/memory-chat.js

@@ -34,8 +34,8 @@ function initMemoryChat() {
         + '<div class="card" style="height:550px; display:flex; flex-direction:column;">'
         + '  <div class="card-header py-2 d-flex align-items-center justify-content-between">'
         + '    <div>'
-        + '      <button class="btn btn-sm btn-outline-primary active me-1" id="chat-tab-btn" onclick="showChatPanel()"><i class="bi bi-chat-dots"></i> Ask Memory</button>'
-        + '      <button class="btn btn-sm btn-outline-secondary" id="detail-tab-btn" onclick="showDetailPanel()"><i class="bi bi-info-circle"></i> Detail</button>'
+        + '      <button class="btn btn-sm btn-outline-primary active me-1" id="chat-tab-btn" data-act-click="show-chat-panel"><i class="bi bi-chat-dots"></i> Ask Memory</button>'
+        + '      <button class="btn btn-sm btn-outline-secondary" id="detail-tab-btn" data-act-click="show-detail-panel"><i class="bi bi-info-circle"></i> Detail</button>'
         + '    </div>'
         + '    <span class="badge bg-secondary" id="chat-mode-badge" style="font-size:0.7rem;">Mode A</span>'
         + '  </div>'
@@ -47,7 +47,7 @@ function initMemoryChat() {
         // Quick actions
         + '    <div id="chat-quick-actions" class="px-2 py-1 border-top" style="font-size:0.75rem;">'
         + '      ' + QUICK_ACTIONS.map(function(a) {
-            return '<button class="btn btn-sm btn-outline-secondary me-1 mb-1" onclick="sendChatQuery(\'' + a.query.replace(/'/g, "\\'") + '\')">' + a.label + '</button>';
+            return '<button class="btn btn-sm btn-outline-secondary me-1 mb-1" data-act-click="send-chat-query" data-query="' + escapeHtml(a.query).replace(/"/g, '&quot;') + '">' + a.label + '</button>';
         }).join('')
         + '    </div>'
 
@@ -55,11 +55,11 @@ function initMemoryChat() {
         + '    <div class="p-2 border-top">'
         + '      <div class="input-group input-group-sm">'
         + '        <input type="text" class="form-control" id="chat-input" placeholder="Ask your memory..."'
-        + '               onkeydown="if(event.key===\'Enter\')sendChatFromInput()">'
-        + '        <button class="btn btn-primary" onclick="sendChatFromInput()" id="chat-send-btn">'
+        + '               data-act-keydown="chat-submit-on-enter">'
+        + '        <button class="btn btn-primary" data-act-click="send-chat-from-input" id="chat-send-btn">'
         + '          <i class="bi bi-send"></i>'
         + '        </button>'
-        + '        <button class="btn btn-outline-danger d-none" onclick="cancelChat()" id="chat-cancel-btn">'
+        + '        <button class="btn btn-outline-danger d-none" data-act-click="cancel-chat" id="chat-cancel-btn">'
         + '          <i class="bi bi-stop-circle"></i>'
         + '        </button>'
         + '      </div>'
@@ -241,7 +241,7 @@ function _renderMessages() {
             var citation = msg.citations[idx];
             if (citation) {
                 return '<a href="#" class="badge bg-primary text-decoration-none" '
-                    + 'onclick="event.preventDefault(); _onCitationClick(\'' + citation.fact_id + '\')" '
+                    + 'data-act-click="citation-click" data-fact-id="' + citation.fact_id + '" '
                     + 'title="' + (citation.content_preview || '').replace(/"/g, '&quot;') + '">'
                     + match + '</a>';
             }

package/src/superlocalmemory/ui/js/ng-entities.js

@@ -49,7 +49,7 @@
     var html =
       '<div style="margin-bottom:16px">' +
         '<input type="text" class="form-control" id="entity-search-input" placeholder="Search ' + total + ' entities..." ' +
-          'oninput="filterEntities(this.value)" style="max-width:500px">' +
+          'data-act-input="filter-entities" style="max-width:500px">' +
       '</div>';
 
     // Stats summary
@@ -76,7 +76,7 @@
       for (var i = 0; i < Math.min(pages, 10); i++) {
         var isActive = i === currentP;
         html += '<button class="ng-btn' + (isActive ? ' ng-btn-accent' : '') + '" ' +
-          'onclick="navigateEntityPage(' + i + ')" style="min-width:36px">' + (i + 1) + '</button>';
+          'data-act-click="navigate-entity-page" data-page="' + i + '" style="min-width:36px">' + (i + 1) + '</button>';
       }
       if (pages > 10) html += '<span style="padding:8px;color:var(--ng-text-tertiary)">...</span>';
       html += '</div>';
@@ -97,10 +97,8 @@
       : '';
 
     return '<div class="col-md-6 col-lg-4">' +
-      '<div class="ng-glass" style="padding:16px;cursor:pointer;transition:border-color 0.2s;' + borderAccent + '" ' +
-        'onclick="showEntityDetail(\'' + escapeAttr(entity.name) + '\')" ' +
-        'onmouseover="this.style.borderColor=\'var(--ng-border-prominent)\'" ' +
-        'onmouseout="this.style.borderColor=\'var(--ng-border-subtle)\'">' +
+      '<div class="ng-glass ng-hover-border" style="padding:16px;cursor:pointer;transition:border-color 0.2s;' + borderAccent + '" ' +
+        'data-act-click="show-entity-detail" data-entity="' + escapeHtml(entity.name).replace(/"/g, '&quot;') + '">' +
         '<div style="display:flex;justify-content:space-between;align-items:flex-start;margin-bottom:8px">' +
           '<div style="font-weight:590;font-size:0.9375rem;color:var(--ng-text-primary)">' +
             '<i class="bi ' + typeIcon + '" style="color:' + typeColor + ';margin-right:4px"></i>' +
@@ -143,9 +141,9 @@
         '<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:16px">' +
           '<h5 style="margin:0"><i class="bi bi-person-badge"></i> ' + escapeHtml(entityName) + '</h5>' +
           '<div style="display:flex;gap:8px">' +
-            '<button class="ng-btn" onclick="recompileEntity(\'' + escapeAttr(entityName) + '\')">' +
+            '<button class="ng-btn" data-act-click="recompile-entity" data-entity="' + escapeHtml(entityName).replace(/"/g, '&quot;') + '">' +
               '<i class="bi bi-arrow-repeat"></i> Recompile</button>' +
-            '<button class="ng-btn" onclick="document.getElementById(\'entity-detail-panel\').style.display=\'none\'">' +
+            '<button class="ng-btn" data-act-click="close-entity-detail">' +
               '<i class="bi bi-x-lg"></i></button>' +
           '</div>' +
         '</div>' +

package/src/superlocalmemory/ui/js/ng-ingestion.js

@@ -127,14 +127,14 @@
         '<div style="display:flex;gap:8px">' +
           (isEnabled ?
             (isRunning ?
-              '<button class="ng-btn" onclick="adapterAction(\'' + adapter.name + '\',\'stop\')">' +
+              '<button class="ng-btn" data-act-click="adapter-action" data-adapter="' + adapter.name + '" data-adapter-action="stop">' +
                 '<i class="bi bi-stop-circle"></i> Stop</button>' :
-              '<button class="ng-btn ng-btn-accent" onclick="adapterAction(\'' + adapter.name + '\',\'start\')">' +
+              '<button class="ng-btn ng-btn-accent" data-act-click="adapter-action" data-adapter="' + adapter.name + '" data-adapter-action="start">' +
                 '<i class="bi bi-play-circle"></i> Start</button>'
             ) +
-            '<button class="ng-btn" onclick="adapterAction(\'' + adapter.name + '\',\'disable\')" style="color:var(--ng-status-error)">' +
+            '<button class="ng-btn" data-act-click="adapter-action" data-adapter="' + adapter.name + '" data-adapter-action="disable" style="color:var(--ng-status-error)">' +
               '<i class="bi bi-x-circle"></i> Disable</button>' :
-            '<button class="ng-btn ng-btn-accent" onclick="adapterAction(\'' + adapter.name + '\',\'enable\')">' +
+            '<button class="ng-btn ng-btn-accent" data-act-click="adapter-action" data-adapter="' + adapter.name + '" data-adapter-action="enable">' +
               '<i class="bi bi-power"></i> Enable</button>'
           ) +
         '</div>' +

package/src/superlocalmemory/ui/js/ng-mesh.js

@@ -12,17 +12,12 @@
   // Dashboard callers authenticate with the install token so we never
   // embed the mesh secret in JS. Token is fetched from /internal/token
   // (loopback-only endpoint) and cached in sessionStorage for the tab session.
-  var TOKEN_STORAGE_KEY = 'slm_install_token';
+  // B2 (3.7.9): keep the token in a private closure var, never sessionStorage.
+  var _tokenCache = null;
 
-  function readToken() {
-    try { return window.sessionStorage ? window.sessionStorage.getItem(TOKEN_STORAGE_KEY) : null; }
-    catch (e) { return null; }
-  }
+  function readToken() { return _tokenCache; }
 
-  function writeToken(value) {
-    try { if (window.sessionStorage) window.sessionStorage.setItem(TOKEN_STORAGE_KEY, value); }
-    catch (e) { /* storage disabled */ }
-  }
+  function writeToken(value) { _tokenCache = value; }
 
   function fetchTokenFromServer() {
     return fetch('/internal/token', { credentials: 'same-origin' })

package/src/superlocalmemory/ui/js/ng-shell.js

@@ -115,7 +115,7 @@
 
     footer.innerHTML =
       // v3.4.10: Cloud Backup Account Widget
-      '<div id="ng-account-widget" style="margin-bottom:10px;padding:8px;border-radius:10px;background:rgba(255,255,255,0.03);border:1px solid rgba(255,255,255,0.06);cursor:pointer;" onclick="document.querySelector(\'[data-target=settings]\')?.click()">' +
+      '<div id="ng-account-widget" style="margin-bottom:10px;padding:8px;border-radius:10px;background:rgba(255,255,255,0.03);border:1px solid rgba(255,255,255,0.06);cursor:pointer;" data-act-click="open-settings-tab">' +
         '<div style="display:flex;align-items:center;gap:8px;">' +
           '<span id="ng-account-avatar" style="width:28px;height:28px;border-radius:50%;background:rgba(255,255,255,0.08);display:flex;align-items:center;justify-content:center;font-size:13px;flex-shrink:0;overflow:hidden;">' +
             '<i class="bi bi-cloud-slash" style="font-size:13px;opacity:0.4;"></i>' +
@@ -128,16 +128,16 @@
         '</div>' +
         '<div id="ng-account-actions" style="display:none;margin-top:8px;padding-top:8px;border-top:1px solid rgba(255,255,255,0.05);">' +
           '<div style="display:flex;gap:4px;">' +
-            '<button class="ng-btn" onclick="event.stopPropagation();connectGoogleDrive()" title="Connect Google Drive" style="flex:1;justify-content:center;font-size:11px;padding:4px;">' +
+            '<button class="ng-btn" data-act-click="connect-google-drive" title="Connect Google Drive" style="flex:1;justify-content:center;font-size:11px;padding:4px;">' +
               '<i class="bi bi-google" style="color:#4285f4;"></i>' +
             '</button>' +
-            '<button class="ng-btn" onclick="event.stopPropagation();connectGitHub()" title="Connect GitHub" style="flex:1;justify-content:center;font-size:11px;padding:4px;">' +
+            '<button class="ng-btn" data-act-click="connect-git-hub" title="Connect GitHub" style="flex:1;justify-content:center;font-size:11px;padding:4px;">' +
               '<i class="bi bi-github"></i>' +
             '</button>' +
-            '<button class="ng-btn" onclick="event.stopPropagation();syncCloudNow()" title="Sync Now" style="flex:1;justify-content:center;font-size:11px;padding:4px;">' +
+            '<button class="ng-btn" data-act-click="sync-cloud-now" title="Sync Now" style="flex:1;justify-content:center;font-size:11px;padding:4px;">' +
               '<i class="bi bi-cloud-upload" style="color:#00D4AA;"></i>' +
             '</button>' +
-            '<button class="ng-btn" onclick="event.stopPropagation();exportBackup()" title="Export Backup" style="flex:1;justify-content:center;font-size:11px;padding:4px;">' +
+            '<button class="ng-btn" data-act-click="export-backup" title="Export Backup" style="flex:1;justify-content:center;font-size:11px;padding:4px;">' +
               '<i class="bi bi-download" style="color:#f39c12;"></i>' +
             '</button>' +
           '</div>' +
@@ -151,10 +151,10 @@
         '<button class="ng-btn" id="ng-refresh-btn" title="Refresh" style="flex:1;justify-content:center">' +
           '<i class="bi bi-arrow-clockwise"></i>' +
         '</button>' +
-        '<button class="ng-btn" id="ng-theme-toggle" title="Toggle theme" onclick="toggleDarkMode()" style="flex:1;justify-content:center">' +
+        '<button class="ng-btn" id="ng-theme-toggle" title="Toggle theme" data-act-click="toggle-dark-mode" style="flex:1;justify-content:center">' +
           '<i class="bi bi-sun-fill" id="ng-theme-icon"></i>' +
         '</button>' +
-        '<button class="ng-btn" id="ng-privacy-btn" title="Privacy blur (for screen recording)" onclick="togglePrivacyBlur()" style="flex:1;justify-content:center">' +
+        '<button class="ng-btn" id="ng-privacy-btn" title="Privacy blur (for screen recording)" data-act-click="toggle-privacy-blur" style="flex:1;justify-content:center">' +
           '<i class="bi bi-eye-slash" id="ng-privacy-icon"></i>' +
         '</button>' +
         '<a href="https://github.com/qualixar/superlocalmemory" target="_blank" class="ng-btn" title="Star on GitHub" style="flex:1;justify-content:center">' +
@@ -364,7 +364,7 @@
       case 'health-pane':
         // v3.4.21 / v3.4.21 (taxonomy): Health = runtime health ONLY
         // (Daemon, Events, Agents, IDEs, Math). Governance concerns live
-        // in operations-pane. IDEs folded in v3.4.21 per Varun — they're
+        // in operations-pane. IDEs folded in v3.4.21 — they're
         // connected-client state, same category as Agents.
         if (typeof loadHealthMonitor === 'function') loadHealthMonitor();
         if (typeof initEventStream === 'function') initEventStream();

package/src/superlocalmemory/ui/js/ng-skills.js

@@ -47,11 +47,38 @@
             '</div>' +
             '<div style="display:flex;gap:8px">' +
               (enabled
-                ? '<button class="btn btn-sm btn-outline-success" onclick="triggerEvolution()"><i class="bi bi-play-fill"></i> Run Now</button>'
-                : '<button class="btn btn-sm btn-outline-primary" onclick="enableEvolution()"><i class="bi bi-power"></i> Enable</button>') +
+                ? '<button class="btn btn-sm btn-outline-success" data-act-click="trigger-evolution"><i class="bi bi-play-fill"></i> Run Now</button>'
+                : '<button class="btn btn-sm btn-outline-primary" data-act-click="enable-evolution"><i class="bi bi-power"></i> Enable</button>') +
             '</div>' +
           '</div>';
 
+        // Per-step evolution model config (v3.7.9) — shown when enabled.
+        if (enabled) {
+          var cfg = data.config || {};
+          var modelOpts = function(sel) {
+            var cur = sel || 'auto';
+            if (cur === '') cur = 'auto';
+            return ['auto', 'haiku', 'sonnet', 'ollama'].map(function(m) {
+              return '<option value="' + m + '"' + (m === cur ? ' selected' : '') + '>' + m + '</option>';
+            }).join('');
+          };
+          html += '<div style="margin-top:12px;border-top:1px solid var(--bs-border-color);padding-top:12px">' +
+            '<div style="font-size:0.8125rem;font-weight:600;margin-bottom:8px">Evolution models ' +
+              '<span style="font-weight:400;color:var(--ng-text-tertiary,#888)">(lowest-cost by default)</span></div>' +
+            '<div style="display:flex;gap:12px;flex-wrap:wrap;align-items:flex-end">' +
+              '<label style="font-size:0.75rem">Generate<br><select id="evo-mutation-model" class="form-select form-select-sm">' + modelOpts(cfg.mutation_model) + '</select></label>' +
+              '<label style="font-size:0.75rem">Verify<br><select id="evo-verify-model" class="form-select form-select-sm">' + modelOpts(cfg.verify_model) + '</select></label>' +
+              '<label style="font-size:0.75rem">Confirm<br><select id="evo-confirm-model" class="form-select form-select-sm">' + modelOpts(cfg.confirm_model) + '</select></label>' +
+              '<label style="font-size:0.75rem">Max/cycle<br><input id="evo-max-cycle" type="number" min="1" max="50" value="' + (cfg.max_per_cycle || 3) + '" class="form-control form-control-sm" style="width:84px"></label>' +
+              '<button class="btn btn-sm btn-primary" data-act-click="save-evolution-config"><i class="bi bi-save"></i> Save</button>' +
+            '</div>' +
+            '<div style="font-size:0.7rem;color:var(--ng-text-tertiary,#888);margin-top:8px">' +
+              '⚠ Evolution makes background LLM calls during consolidation (capped 10/cycle, 3 cycles/day). ' +
+              '“auto” picks the cheapest capable model for your backend; the verifier stays independent of the generator.' +
+            '</div>' +
+          '</div>';
+        }
+
         // Evolution history (if any)
         if (data.recent && data.recent.length > 0) {
           html += '<div style="margin-top:12px;border-top:1px solid var(--bs-border-color);padding-top:12px">' +
@@ -105,6 +132,31 @@
       .catch(function(err) { alert('Error: ' + err.message); });
   };
 
+  window.saveEvolutionConfig = function() {
+    var g = function(id) { var e = document.getElementById(id); return e ? e.value : undefined; };
+    var body = {
+      mutation_model: g('evo-mutation-model'),
+      verify_model: g('evo-verify-model'),
+      confirm_model: g('evo-confirm-model'),
+    };
+    var mx = g('evo-max-cycle');
+    if (mx) body.max_evolutions_per_cycle = parseInt(mx, 10);
+    fetch('/api/evolution/config', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    })
+      .then(function(r) { return r.json(); })
+      .then(function(data) {
+        if (data.ok) {
+          loadSkillEvolution();
+        } else {
+          alert('Could not save evolution config: ' + (data.error || 'unknown'));
+        }
+      })
+      .catch(function(err) { alert('Error: ' + err.message); });
+  };
+
   function fetchSkillOverview() {
     var el = document.getElementById('skills-overview-cards');
     if (!el) return;